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AN EXAMINATION OF CHILDREN’S PRIVACY: 
NEW TECHNOLOGIES AND THE CHILDREN’S 
ONLINE PRIVACY PROTECTION ACT 


THURSDAY, APRIL 29, 2010 

U.S. Senate, 

Subcommittee on Consumer Protection, Product 

Safety, and Insurance, 

Committee on Commerce, Science, and Transportation, 

Washington, DC. 

The Subcommittee met, pursuant to notice, at 10:07 a.m. in room 
SR-253, Russell Senate Office Building, Hon. Mark Pryor, Chair- 
man of the Subcommittee, presiding. 

OPENING STATEMENT OF HON. MARK PRYOR, 

U.S. SENATOR FROM ARKANSAS 

Senator Pryor. I’ll go ahead and call our hearing to order this 
morning. 

I want to welcome our witnesses, thank all of you all for being 
here. 

This morning, we’ll examine children’s privacy and how well the 
Children’s Online Privacy Protection Act, or COPPA, is working. 

The Consumer Protection Subcommittee has jurisdiction over the 
Federal Trade Commission, which enforces this statute. The FTC 
is currently engaged in reexamining the implementation and effec- 
tiveness of COPPA. Protecting our children’s online privacy and 
safety is a critical issue whose importance cannot be overstated. 
Online abuses, such as harassment, threats, and cyberbullying 
should never be tolerated. 

Today’s discussion could not come at a more pivotal time, as 
technology developments and innovations, while greatly beneficial 
in many respects, contribute to the complexity of today’s online 
space. 

I’m concerned about our kids’ online safety, for a number of rea- 
sons: 

First, we know that, while some companies are making great 
strides to protect young people from predators and online dangers, 
the disclosure of personal information by young people is prevalent. 
Researchers are still unpacking the implications of this disclosure. 

Second, recent reports have suggested that location-based adver- 
tising is tied to social networking. It also appears that certain tech- 
nologies, such as GPS tracking capabilities, could track children, 
without their knowledge. As more kids have access to phones, and 
as tracking devices and mobile technologies increase in sophistica- 
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tion, greater understanding of how children could be impacted is 
essential. 

Third, we know that our young children are using the Internet 
now more than ever before, and we know that they represent a 
large portion of total online activity. And, according to one report, 
in the last 5 years, we have seen the time spent online by kids ages 
2 to 11 — ages 2 to 11 — increase by 63 percent. Children of that age 
make up almost 10 percent of online users. 

I’m interested in all the witnesses’ thoughts regarding the appro- 
priateness of the statute’s age limits, what constitutes children’s 
personal information, how parental consent is best achieved, and 
how operators maintain the confidentiality and security of the in- 
formation that they do collect, when authorized, about children. 

I know that this FTC is considering both how to better prevent 
the authorized collection or the use of children’s information, and 
how to educate parents and teachers about the importance of en- 
couraging children to protect themselves online. 

And I look forward to hearing from all of our witnesses, espe- 
cially FTC, on what they’re doing. And I also want to thank all of 
our witnesses for being here today. 

Not all members of the business community were willing to 
present their views. Specifically, we had asked Apple and Google 
to come, but they declined. I think that’s unfortunate, because they 
are major players in this area. And we’re going to have a long and 
in-depth conversation that starts today, but this is going to go on 
into the future, and I think it’s unfortunate that Apple and Google 
chose not to participate in this discussion. 

So, with that, I’d like to turn it over to my Ranking Member, 
Senator Wicker. 

STATEMENT OF HON. ROGER F. WICKER, 

U.S. SENATOR FROM MISSISSIPPI 

Senator Wicker. Thank you, Mr. Chairman, for holding this im- 
portant hearing to examine the Children’s Online Privacy Protec- 
tion Act, COPPA, and its application in today’s ever-changing tech- 
nological world. 

We, as the Subcommittee responsible for consumer protection, 
are mindful that protecting our children is essential, and I applaud 
you, Mr. Chairman, for your commitment toward this goal. 

The Internet provides the opportunity to share information for 
both adults and children. This has led to our current revolution in 
the availability of information to almost anyone who has access to 
a computer. 

A flood of information, however, brings new challenges. One such 
challenge has been how to ensure the privacy of information for 
children when they use the Internet. 

COPPA was created to address the privacy concerns that arise 
with Internet users under the age of 13. This law has worked for 
many years to maintain the security of children’s personal informa- 
tion when it is collected online. It also ensures that parents know 
what tools and resources are available to help them be more aware 
of, and have some control over, what their children are doing on- 
line. 
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I commend the FTC for its continued efforts to enhance parents’ 
involvement in children’s online activities. I particularly want to 
highlight the consumer education efforts at the FTC. Making con- 
sumers and businesses aware of their rights and responsibilities is 
one of the most effective ways to ensure that the law achieves its 
goals. 

One of the best examples of this is the FTC’s NetCetera guide, 
which teaches adults how to explain to children the risks that can 
be associated with online conduct. However, even with these ef- 
forts, there are still many challenges parents face in protecting 
their children’s information online, and it is important that the law 
be equipped to meet those challenges as they develop. 

Keeping pace with technological changes is a difficulty that many 
industries face. It seems that, almost every day, a new service, a 
new application, or a new product is unveiled that is a little faster, 
a little better, and a little more complicated than we were using 
yesterday. This presents new and unique challenges in efforts to 
make sure that technologies are safe for consumers. 

I’ve been a parent for many years, and it is important to me to 
keep my children safe. I’m also a new grandparent, and I’m 
amazed to think about the opportunities that my 5-week-old grand- 
daughter will have. Her generation will be able to access informa- 
tion and learn so much more than those of us in this room ever 
imagined. A significant portion of those opportunities will be avail- 
able through online technology and innovations occurring today, to- 
morrow, and years into the future. These rapid and continued tech- 
nological changes, however, can make it difficult to consider regula- 
tions for the Internet. 

Our first priority is to ensure safety, but we must also take care 
not to stifle innovation and business development that drives our 
economy and makes possible so many of the opportunities available 
to our children. 

There have been many suggestions about ways to improve 
COPPA and help it meet Congress’s goals in today’s world. How- 
ever, there have also been many concerns expressed about the ef- 
fect that these changes could have, not only on innovation, but also 
on the very goals that COPPA strives to achieve. I think it’s impor- 
tant for us to take time to consider these conflicting concerns and 
better understand their ramifications in both children’s online pri- 
vacy and children’s online experience. 

Thank you, Mr. Chairman. 

Senator Pryor. Thank you. 

Senator Rockefeller? 

STATEMENT OF HON. JOHN D. ROCKEFELLER IV, 

U.S. SENATOR FROM WEST VIRGINIA 

The Chairman. Thank you, Mr. Chairman. 

And you’ve already pointed out the 60 million children who are 
availing themselves of these technologies, these days. And I lis- 
tened to the good Senator from Mississippi, and I understand the 
need to encourage innovation. But, every time it’s a choice between 
protecting children or protecting privacy and protecting innovation, 
we always seem to go with innovation, and we never go with pri- 
vacy. So, that’s what COPPA is all about. 
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And I’m shocked — I’m absolutely shocked that children from 2 to 
the age of 13 — which is totally irrelevant, really; I mean, it ought 
to be “children” — “children are children up until 25,” or something 
like that, aren’t they? I mean, they’re just 

[Laughter.] 

The Chairman. It’s ridiculous. So, they get YouTube, Google, 
Facebook, and then two somewhat less decent terms that no parent 
would want their child searching for on the web. And, of course, 
that’s the point. 

So, accessing these websites, whether they’re well known or pop- 
ular or outright illegal, have enormous privacy considerations. And 
this is not an innovation meeting; this is a privacy meeting. We do 
that in this committee; we protect people. And particularly, we pro- 
tect children, because they are the most vulnerable of all. 

So, a lot of these companies are collecting personal information, 
and that’s a benign term, until it becomes very unbenign and peo- 
ple are giving up all kinds of information that — they have no idea. 

So, we passed COPPA, as has been indicated. And the idea was 
to keep personal information private. But, then the whole world 
has changed since that happened, technologically. The entire world 
has changed. And so, the FTC began an important effort to review 
its rules. It actually probably should have done so — started some- 
what earlier; and I want to talk about that, but at least they’re 
doing it. And I really think that Congress has to take a very hard 
look at whether COPPA should be updated, if FTC isn’t going to 
do it, to cover new kinds of information, new businesses. 

And I look forward to working with Senator Pryor. And I want 
to echo what he said. I appreciate the fact that Microsoft and 
Facebook are here. I also do not appreciate the fact that Apple and 
Google are not here. And I’m curious as to why they’re not. Was 
it too expensive to send an associate or legal counsel? Was it a fi- 
nancial matter; they couldn’t get the people here because they 
couldn’t afford the plane tickets? Were they trying to avoid some- 
thing? Were they trying to hide something? When people don’t 
show up when we ask — I have this power of the subpoena, which 
I would absolutely love to use. I have not, to this point. But, what 
it all does, it increases our interest in what they’re doing and why 
they didn’t show up. So, they made a stupid mistake by not show- 
ing up today, and I say, “Shame on them.” 

So, this is an introductory hearing. We’re starting an important 
public discussion; all of us here, tremendously interested in this. 
And, you know, children’s safety comes first, always. 

And so, we begin. And, as the Chairman has said, this is going 
to be the first of a number of hearings. Children are to be taken 
seriously. They’re not. They’re part of an age that we’re not part 
of in technology, and it’s dangerous for them. There are all kinds 
of horrible things that they can see; parents don’t know about it. 
They don’t know about it, they don’t know what the rules are. And 
so, we have responsibilities. 

I thank the Chair. 

[The prepared statement of Senator Rockefeller follows:] 
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Prepared Statement of Hon. John D. Rockefeller IV, 

U.S. Senator from West Virginia 

Thank you, Senator Pryor, for your outstanding work as Chairman of the Sub- 
committee on Consumer Protection. 

According to a recent study, children ages 2 through 11 make up 9.5 percent of 
online users. That’s nearly 16 million children, and the number is rapidly growing. 

A decade ago, going online meant accessing the Internet on a computer in your 
home. Today, it also includes iPhones, portable games, and interactive TVs. As pow- 
erful and exciting as these new developments are, a changing world brings new 
risks. 

For instance, a recent survey found that the top five Internet searches by children 
under 13 were for the terms: “YouTube,” “Google,” “Facebook,” and two somewhat 
less decent terms that no parent would want their young child searching for on the 
web. 

Accessing these websites, whether they are well-known and popular or outright 
illegal, have enormous privacy implications that I fear parents are unaware of, and 
I know children do not understand. 

Many companies are collecting personal information and monetizing it. This com- 
mercial practice has a particular impact on our children. 

We have a responsibility to understand this rapidly changing digital landscape 
and to give parents the tools they need to protect their children’s privacy. 

In 1988, we passed the Children’s Online Privacy Protection Act, or “COPPA”, re- 
quiring websites to get parents’ consent before collecting or using any personal in- 
formation from children. 

Since then, the way children use the Internet has changed dramatically. Some on- 
line technologies that are nearly ubiquitous today did not even exist a few years 
ago. 

So in January, the FTC began an important effort to review its rules. But with 
such rapid change, I firmly believe Congress also must take a hard look at whether 
COPPA should be updated to cover new kinds of information and new businesses. 
I look forward to working with Senator Pryor in this examination. 

I very much want to thank Microsoft and Facebook for testifying. I have to say 
that I am disappointed Apple and Google have declined to participate today. These 
two companies are at the forefront of technological developments in the online 
world. 

With this introductory hearing, we are starting an important public discussion 
with direct implications on children’s privacy. Apple and Google’s refusal to take 
part does not speak well of their commitment to working with Congress on this 
issue going forward. 

I want to close by noting that children’s privacy is strongly connected to children’s 
safety, and I believe in my core that all children deserve special protections. Always. 
Period. 

It’s important not to conflate the two issues, but privacy and safety most certainly 
overlap. 

To parents, nothing is more important than protecting our children. Nothing. I am 
enormously alarmed by the rise in criminal behavior targeting children online, from 
“cyber-bullying” to adult predators. 

These frightening trends are directly connected to the fact that our children’s sen- 
sitive, personal information is being increasingly exposed to the public. 

I look forward to continuing this important discussion and working together — 
Congress, the FTC, and online stakeholders — to make sure nothing comes before the 
safety and security of our children. 

Senator Pryor. Thank you, Mr. Chairman. 

And I would note for the record that Chairman Rockefeller has 
a long and distinguished and successful career in protecting chil- 
dren. 

Senator Klobuchar. 

STATEMENT OF HON. AMY KLOBUCHAR, 

U.S. SENATOR FROM MINNESOTA 

Senator Klobuchar. Thank you very much, Mr. Chairman. 

And thank you, also, Senator Rockefeller, for all the work you’ve 
done in this area. 



6 


It’s remarkable, as my colleagues have noted, how quickly tech- 
nology has changed over the last few years. The old joke — I still re- 
member this — people would say, “Well, if you want to program your 
VCR, ask your kid.” But, now VCRs are a thing of the past. New 
technologies, devices, programs, and applications have completely 
changed the way we work and the way we communicate. From 
GPS and GeoLocation on Smartphones, to the ubiquity of text-mes- 
saging and Twitter, to posting our photos on social networking 
sites, the world is quickly changing. 

And no group adapts to new technology quicker than young peo- 
ple. And as was noted by my colleagues, nearly 16 million kids 
aged 2 through 11 are active online, and they make up, I think, 
9.5 percent of online users. And these numbers are growing as 
more and more young people are logging on. The average young 
child spends more than 11 hours a month on the Internet, a 63- 
percent increase over 5 years ago. And this is one of the more sad 
facts. One survey found that the top five Internet searches for chil- 
dren under 13 are YouTube, Google, Facebook, sex, and porn. 

Clearly, the online world has changed dramatically. I think if you 
look back when these COPPA rules were adopted, 10 years ago, 
that wouldn’t have been the case; you probably could have hardly 
even checked what kids were checking, and they probably weren’t 
checking into any of these things. And so, it is very important that 
we examine this rule to ensure that it keeps up with the tech- 
nology. 

I’ve just heard a lot of stories in our state, working with Senator 
Thune on the peer-to-peer legislation that we have, of changing 
technology that while it’s so great in so many ways for innovation, 
has also severely hurt people’s privacy rights. And when it comes 
to kids, we reach a whole new level. 

So, I’m looking forward to working with my colleagues to work 
on this rule and make changes that are in the best interest of ev- 
eryone. 

Thank you very much. 

Senator Pryor. Thank you, Senator Klobuchar. 

And I would like to say that, for all of our witnesses — we have 
a very distinguished panel today, and that we could spend a lot of 
time introducing them and going through all their experiences and 
their degrees and all their backgrounds. And it’s a very impressive 
group. But, that is all part of the record. 

And so, what I’m going to do is, I’m just going to go down the 
line, introduce each one, and ask each one to make a 5-minute 
opening statement. And what I’d like for you all to do is just pay 
attention to the lights there in front of you, and when 5 minutes 
is over, we would love for you to, you know, wrap it up. 

First, I would like to introduce Jessica Rich; she’s the Deputy Di- 
rector of the Bureau of Consumer Protection at the Federal Trade 
Commission. Second is Timothy Sparapani, Director of Public Pol- 
icy at Facebook. Next is Mike Hintze; he’s the Associate General 
Counsel at Microsoft. Next is Kathryn Montgomery, Ph.D.; she’s 
Professor of School of Communications at American University. 
Next is Marc Rotenberg; he’s Executive Director of Electronic Pri- 
vacy Information Center. And last, and certainly not least, at the 
children’s table, here 
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[Laughter.] 

Senator Pryor. — we have — and I’m sorry that our table is only 
so long this morning — but, anyway, we have Berin Szoka; he’s Sen- 
ior Fellow, Director of the Center for Internet Freedom at The 
Progress & Freedom Foundation. 

So, thank all of you all for being here. 

And, Ms. Rich, if you could lead us off. 

STATEMENT OF JESSICA RICH, DEPUTY DIRECTOR, BUREAU 
OF CONSUMER PROTECTION, FEDERAL TRADE COMMISSION 

Ms. Rich. Mr. Chairman and members of the Committee, I’m 
Jessica Rich, Deputy Director of the Bureau of Consumer Protec- 
tion at the Federal Trade Commission. I appreciate this oppor- 
tunity to update you regarding the FTC’s work to protect children’s 
privacy and enforce the Children’s Online Privacy Protection Act, 
or COPPA. 

We have submitted a written statement today which represents 
the views of the FTC. The views expressed orally, and my re- 
sponses to questions, are my own and do not necessarily reflect the 
views of the Commission or any commissioner. 

The Federal Trade Commission is deeply committed to helping to 
create a safer, more secure online experience for children. The 
Commission’s rule implementing COPPA became effective 10 years 
ago. The statute and rule apply to operators of websites and online 
services directed to children under age 13 and to other website op- 
erators that have actual knowledge that they are collecting infor- 
mation from children. 

Covered website operators must provide notice of their informa- 
tion collection practices and, with limited exception, obtain 
verifiable parental consent prior to the collection, use, or disclosure 
of personal information from children. Operators also must give 
parents the opportunity to review and delete personal information 
that their children have provided. 

The Commission has taken a multipronged approach to rule com- 
pliance that includes enforcement, education, and implementation 
of the statutory mandated COPPA safe harbor program. On the en- 
forcement side, the Commission has brought 14 law enforcement 
actions alleging COPPA violations. The FTC’s early COPPA cases 
focused on children’s sites that collected extensive amounts of per- 
sonal information without providing notice to parents and obtain- 
ing their consent. 

More recent enforcement actions have focused on operators of 
both general audience and child-directed social networking sites, 
and sites with interactive features that permit children to divulge 
their personal information online. 

A crucial complement to our law enforcement efforts is educating 
businesses about their responsibilities under the law. The FTC has 
published comprehensive compliance materials, which are available 
on our website. We also devote significant resources to answering 
individual requests from companies about rule compliance, and to 
conducting outreach to industry groups. Our goal in these efforts 
is to prevent COPPA violations before they occur. 

The Commission’s consumer education materials aim to inform 
parents and children about the protections afforded by the rule, so 
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they know what to expect and what to look for as they navigate 
online. These materials are available through the Commission’s on- 
line safety portal, OnGuardOnline.gov. OnGuardOnline provides 
practical and plain-language information about COPPA and other 
privacy and safety topics, in a variety of formats, including articles, 
games, quizzes, and videos. 

Our most recent addition is the NetCetera guide, which Senator 
Wicker was kind enough to mention at the beginning. 

In light of significant changes to the online environment, includ- 
ing the explosive growth of social networking, mobile web tech- 
nologies, and interactive gaming, the Commission recently initiated 
a review of the rule. 

On March 24 of this year, the Commission launched a public 
comment period aimed at gathering input on a wide range of 
issues, including whether the rule’s definition of “Internet” ade- 
quately covers certain types of mobile communications and inter- 
active media, whether the rule’s definition of “personal informa- 
tion” has kept pace with technological developments — that is, 
whether certain information that isn’t named and listed in the rule, 
such as static IP address, could allow a website to contact a child; 
the effectiveness of mechanisms used to — and another topic is the 
effectiveness of mechanisms used authenticate parents who provide 
consent or seek access to their children’s information. 

The comment period for these questions closes on June 30. On 
June 2, the Commission will host a public roundtable, here in 
Washington, to hear from stakeholders, including children’s privacy 
advocates, website operators, businesses, academics, educators, 
parents, anyone who would like to come, on these important issues. 

The Commission takes seriously the challenge to ensure that 
COPPA continues to meet its originally stated goal, even as chil- 
dren’s interactive media use moves from standalone PCs to other 
devices. 

Thank you, and I look forward to your questions. 

[The prepared statement of Ms. Rich follows:] 

Prepared Statement of Jessica Rich, Deputy Director, 

Bureau of Consumer Protection, Federal Trade Commission 

I. Introduction 

Chairman Pryor, Ranking Member Wicker, and members of the Subcommittee, 
my name is Jessica Rich, and I am the Deputy Director of the Bureau of Consumer 
Protection at the Federal Trade Commission (“Commission”). 1 I appreciate the op- 
portunity to appear before you today to discuss the Commission’s implementation 
of the Children’s Online Privacy Protection Act of 1998 (“COPPA”). 2 

The Federal Trade Commission is deeply committed to helping to create a safer, 
more secure, online experience for children. As such, the agency has actively en- 
gaged in law enforcement, consumer and business education, and rulemaking initia- 
tives to ensure that knowledge of, and adherence to, COPPA is widespread. In the 
past 10 years, the Commission has brought fourteen law enforcement actions alleg- 
ing COPPA violations and has collected more than $3.2 million in civil penalties. 
In addition, in light of significant changes to the online environment, including the 
explosion of social networking and the proliferation of mobile web technologies and 


1 While the views expressed in this statement represent the views of the Commission, my oral 
presentation and responses to questions are my own and do not necessarily reflect the views 
of the Commission or any individual Commissioner. 

2 See Children’s Online Privacy Protection Act of 1998, 15 U.S.C. §§6501—6508 (2009). The 
Commission’s implementing regulations (the “COPPA Rule”) are found at 16 C.F.R. Part 312 
(2009). 
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interactive gaming, and the possibility of interactive television, the Commission has 
recently initiated an accelerated review of COPPA’s effectiveness. 

This testimony first provides a brief legislative and regulatory overview of 
COPPA. It next summarizes the Commission’s efforts to enforce COPPA and to edu- 
cate businesses and consumers about the law. Finally, it discusses the Commission’s 
current initiative to review its COPPA Rule in order to determine whether the Rule 
should be modified to address changes in technology that may affect children’s pri- 
vacy. 

II. A Brief COPPA Overview 

A. The Legislation 

Congress enacted COPPA in 1998 to address the unique privacy and safety risks 
created when young children — those under 13 years of age — access the Internet. 
COPPA’s legislative history reveals several critical goals: (1) to enhance parental in- 
volvement in children’s online activities in order to protect children’s privacy; (2) to 
protect children’s safety when they visit and post information on public chat rooms 
and message boards; (3) to maintain the security of children’s personal information 
collected online; and (4) to limit the collection of personal information from children 
without parental consent. 3 

COPPA applies to operators of websites and online services directed to children 
under age 13, and to other website operators that have actual knowledge that they 
are collecting personal information 4 from such children (collectively, “operators”). 
The statute generally mandates that operators covered by the Act provide notice of 
their information collection practices and, with only limited exceptions, obtain 
verifiable parental consent prior to the collection, use, or disclosure of personal in- 
formation from children. Operators also must give parents the opportunity to review 
and delete personal information their children have provided. Operators are re- 
quired to establish and maintain reasonable procedures to protect the security of 
personal information collected from children, and must not condition children’s par- 
ticipation in website activities on the disclosure of more personal information than 
is reasonably necessary. 5 

COPPA contains a safe harbor provision enabling industry groups or others to 
submit to the Commission for approval self-regulatory guidelines to implement the 
statute’s protections. 6 The statute provides that operators who fully comply with an 
approved safe harbor program will be “deemed to be in compliance” with the Com- 
mission’s COPPA Rule for purposes of enforcement. 7 

B. The Commission’s COPPA Rule 

COPPA mandated that the Commission promulgate and enforce regulations to im- 
plement the Act. The Commission published for public comment a proposed Rule in 
April 1999, and in November 1999 published its final Rule, which went into effect 
on April 21, 2000. 8 

The Rule closely follows the statutory language, requiring operators to provide no- 
tice of their information practices to parents and, with limited exceptions, to obtain 
“verifiable parental consent” prior to collecting, using, or disclosing personal infor- 
mation from children under the age of 13. Verifiable parental consent, as set forth 
in the Rule, means that operators must use a consent method that is reasonably 
calculated, in light of available technology, to ensure that the person providing con- 
sent is the child’s parent. 9 The COPPA Rule sets forth a sliding scale approach to 
obtaining verifiable parental consent based upon the risks posed by the intended 


3 See 144 Cong. Rec. S12741 (Oct. 7, 1998) (statement of Sen. Bryan). 

4 COPPA defines personal information as individually identifiable information about an indi- 
vidual collected online, including: a first and last name; a home or other physical address includ- 
ing street name and a name of a city or town; an e-mail address; a telephone number; a Social 

Security number; any other identifier that the Commission determines permits the physical or 
online contacting of a specific individual; or information concerning the child or the parents of 
that child that the website collects online from the child and combines with an identifier de- 
scribed in this paragraph. 15 U.S.C. § 6501(8). 

6 15 U.S.C. § 6503(b)(1). 

6 15 U.S.C. §6504. Since the Commission’s COPPA Rule took effect on April 21, 2000, four 
groups have received Commission approval of their safe harbor programs: the Children’s Adver- 
tising Review Unit of the National Advertising Division of the Council of Better Business Bu- 
reaus (“CARU”), the Entertainment Software Rating Board (“ESRB”), TRUSTe, and Privo, Inc. 
For information on the Commission’s COPPA safe harbor process, see http : / lwww.ftc.gov /pri- 
vacy / privacyinitiatives / childrens shp.html. 

7 15 U.S.C. § 6504(b)(2). 

8 16 C.F.R. §312 (2009). 

9 16 C.F.R. § 312.5(b)(1). 
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uses of the child’s information. 10 Under this approach, operators who keep children’s 
information internal, and do not disclose it publicly or to third parties, may obtain 
parental consent by methods such as sending an e-mail to the parent and then fol- 
lowing up to confirm consent. 11 By contrast, operators who disclose children’s per- 
sonal information to others must use a more reliable method of parental consent — 
either one of the methods outlined by the Commission, or an equivalent method de- 
signed to ensure that the operator is connecting with the child’s parent. 12 

COPPA authorizes the Commission to enforce the Rule in the same manner as 
it does rules promulgated under Section 18(a)(1)(B) of the Federal Trade Commis- 
sion Act prohibiting unfair or deceptive acts or practices. 13 This permits the Com- 
mission to obtain civil penalties against operators who violate the Rule. COPPA fur- 
ther authorizes state attorneys general to enforce compliance with the Rule by filing 
actions in Federal court with written notice to the Commission. 14 

III. The Commission’s COPPA Enforcement and Education Efforts 

A. Enforcing COPPA 

In the 10-years since the Rule’s enactment, the Commission has brought fourteen 
(14) COPPA enforcement actions that cut to the core of COPPA’s goals — ensuring 
that parents are informed and have the right to say “no” before their young children 
divulge their personal information. These rights are especially important when, with 
the mere click of a mouse or the touch of a screen, a child’s personal information 
can be viewed by anyone. Together, the Commission’s actions have garnered more 
than $3.2 million in civil penalties. 15 

In 2006, as social networking exploded onto the youth scene, the Commission re- 
doubled its efforts to enforce COPPA. That year, the Commission obtained an order 
against Xanga.com, a then-popular social blogging site alleged to have knowingly 
collected personal information from, and created blog pages for, 1.7 million underage 
users — without obtaining their parents’ permission. The Xanga.com settlement in- 
cluded a $1 million civil penalty. 16 

In 2008, the Commission obtained orders against two other operators of social net- 
working sites. In January of that year, operators of the child-directed social net- 
working site, Imbee.com, paid $130,000 to settle charges that they allegedly violated 
COPPA by collecting and maintaining personal information from over 10,500 chil- 
dren without first obtaining parental consent. 17 Later that year, Sony BMG Music 
Entertainment paid a $1 million civil penalty to resolve allegations that the com- 
pany knowingly and improperly collected a broad range of personal information 
from at least 30,000 underage children who registered on 196 of its general audience 
music fan sites. 18 

Most recently, the Commission charged Iconix Brand Group, Inc., the owner and 
marketer of several apparel brands popular with children and teens, with collecting 
and storing personal information from approximately 1,000 children without first 
notifying their parents or obtaining parental consent. The Commission’s complaint 
further alleged that on one of its brand websites, Iconix enabled girls to share per- 


10 16 C.F.R. § 312.5(b)(2). 

11 The sliding scale mechanism, which initially was designed to expire in April 2002, was sub- 
sequently extended by the Commission. In 2006, the Commission announced that it would ex- 
tend the sliding scale approach indefinitely. See 71 Fed. Reg. 13247 (Mar. 15, 2006), available 
at www.ftc.gov / os 12006 1031 P054505COPPARuleRetention.pdf. 

12 Such methods include, but are not limited to: using a print-and-send form that can be faxed 
or mailed back to the operator; requiring a parent to use a credit card in connection with a 
transaction; having a parent call a toll-free telephone number staffed by trained personnel; 
using a digital certificate that uses public key technology; and using e-mail accompanied by a 
PIN or password obtained through one of the above methods. 16 C.F.R. § 312.5(b)(2). 

13 15 U.S.C. §§ 6503(c), 6506(a), (d); 15 U.S.C. §57a(a)(l)(B) (2009). 

14 15 U.S.C. § 6505. To date, only the state of Texas has filed law enforcement actions under 
the COPPA statute. See News Release, Office of Texas Attorney General Abbott Takes Action 
Against Web Sites That Illegally Collect Personal Information from Minors: Millions of Children 
Registered With The Popular Sites; Texas first state to take action under COPPA (Dec. 5, 2007), 
http .7 / www.oag.state.tx.us I oagNews / release. php?id=2288 . 

15 News releases detailing each of the Commission’s COPPA cases are available at 
www.ftc.gov / privacy / privacyinitiatives / childrens enf.html. 

16 United States v. Xanga.com, Inc., No. 06-CIV— 6853(SHS) (S.D.N.Y.) (final order Sept. 11, 
2006). 

17 United States v. Industrious Kid, Inc., No. 08-CV— 0639 (N.D. Cal.) (filed Jan. 29, 2008). 

18 United States v. Sony BMG Music Entm’t, No. 08— CV— 10730 (S.D.N.Y.) (final order Dec. 15, 
2008). 
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sonal stories and photos publicly online. Iconix agreed to pay a $250,000 civil pen- 
alty to settle the Commission’s charges. 19 

B. Consumer and Business Education 

Although law enforcement is a critical part of the Commission’s COPPA program, 
enforcement alone cannot accomplish all of the agency’s goals in administering 
COPPA and the Rule. A crucial complement to the Commission’s formal law enforce- 
ment efforts, therefore, is educating consumers and businesses about their rights 
and responsibilities under the law. By promoting business and consumer education, 
the Commission seeks to help the greater online community create a culture that 
protects children’s privacy and security. 

The Commission’s business outreach goals focus broadly on shaping prospective 
practices. The agency devotes significant resources to assisting website operators 
with Rule compliance, regularly updating business education materials and respond- 
ing to inquiries from operators and their counsel. 20 

The Commission’s consumer education materials aim to inform parents and chil- 
dren about the protections afforded by the Rule and also provide them with general 
online privacy and safety information. The Commission’s consumer online safety 
portal, OnGuardOnline.gov, provides practical and plain language information in a 
variety of formats — including articles, games, quizzes, and videos — to help computer 
users guard against Internet fraud, secure their computers, and protect their per- 
sonal information. 21 The Commission’s booklet, Net Cetera: Chatting With Kids 
About Being Online, is a recent addition to OnGuardOnline.gov. This guide gives 
practical tips on how parents, teachers, and other trusted adults can help children 
reduce the risks of inappropriate conduct, contact, and content that come with living 
life online. Net Cetera focuses on the importance of communicating with children 
about issues ranging from cyberbullying to sexting, social networking, mobile phone 
use, and online privacy. 22 The Commission has partnered with schools, community 
groups, and local law enforcement to publicize Net Cetera, and has distributed more 
than 2.5 million copies of the guide since it was introduced in October 2009. 

IV. The Current Regulatory Review 

In 2005, the Commission commenced a statutorily required review of its experi- 
ence in enforcing COPPA. 23 Specifically, Congress directed the Commission to evalu- 
ate: (1) operators’ practices as they relate to the collection, use, and disclosure of 
children’s information, (2) children’s ability to obtain access to the online informa- 
tion of their choice; and (3) the availability of websites directed to children. At the 
same time, the Commission sought public comment on the costs and benefits of the 
Rule, including whether any modifications to the Rule were needed in light of 
changes in technology or in the marketplace. 

After completing that review, in 2007 the Commission reported to Congress that, 
in keeping with the legislative intent, the Rule: (1) played a role in improving opera- 
tors’ information collection practices and providing children with greater online pro- 
tections than in the era prior to its implementation; (2) provided parents with a set 
of effective tools for becoming involved in and overseeing their children’s inter- 
actions online; and (3) did not overly burden operators’ abilities to provide inter- 
active online content for children. Accordingly, the Commission concluded that there 
was a continuing need for those protections, and that the Rule should be retained 


19 United States v. Iconix Brand Group, Inc., No. 09— CV-8864 (S.D.N.Y.) (final order Nov. 5, 
2009). 

20 To facilitate COPPA compliance, the Commission maintains a comprehensive children’s pri- 
vacy area on its website where businesses can find useful publications, including How to Comply 
with the Children’s Online Privacy Protection Rule; You, Your Privacy Policy and COPPA ; and 
How to Protect Kids’ Privacy Online, as well as answers to Frequently Asked Questions (or 
“FAQs”). See http:llwww.ftc.govlprivacylprivacyinitiativeslchildrens.html. Periodically, the 
Commission issues guidance on specific topics, like the Rule’s requirements for the content of 
online privacy notices, and the COPPA “actual knowledge” standard for operators of general au- 
dience websites. In addition, the agency maintains a COPPA Hotline, where staff members offer 
fact-specific guidance in response to questions from website operators. 

21 The OnGuardOnline.gov website is the central component of the OnGuardOnline consumer 
education campaign, a partnership of the Federal Government and the technology community. 
Currently, 13 Federal agencies and a large number of safety organizations are partners on the 
website, contributing content and helping to promote and disseminate consistent messages. 

22 See OnGuardOnline, “Net Cetera: Chatting With Kids About Being Online,” available at 
http:l / www.onguardonline.gov/pdf/tec04.pdf. 

23 See 15 U.S.C. §6506(1). 
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without change. 24 At that time, the Commission also acknowledged that children’s 
growing embrace of mobile Internet technology and interactive general audience 
sites, including social networking sites, without the concomitant development of 
suitable age-verification technologies, presented challenges for COPPA compliance 
and enforcement. 25 

Although the Commission generally reviews its rules approximately every 10 
years, the continued rapid-fire pace of technological change, including an explosion 
in children’s use of mobile devices and participation in interactive gaming, and the 
possibility of interactive television, led the agency to accelerate its COPPA review 
by 5 years, to this year. 26 Accordingly, on March 24, 2010, the Commission an- 
nounced the start of a public comment period aimed at gathering input on a wide 
range of issues relating to the COPPA Rule, including: 

• The implications for COPPA enforcement raised by mobile communications, 
interactive television, interactive gaming, and other similar interactive media 
and whether the Rule’s definition of “Internet” adequately encompasses these 
technologies; 

• Whether operators have the ability, using persistent IP addresses, mobile 
geolocation data, or information collected from children online in connection 
with behavioral advertising, to contact specific individuals, and whether the 
Rule’s definition of “personal information” should be expanded accordingly; 

• How the use of centralized authentication methods (such as Openld) will affect 
individual websites’ COPPA compliance efforts; 27 

• Whether there are additional technological methods to obtain verifiable paren- 
tal consent that should be added to the COPPA Rule, and whether any of the 
methods currently included should be removed; and 

• Whether parents are exercising their rights under the Rule to review or delete 
personal information collected from their children, and what challenges opera- 
tors face in authenticating parents. 28 

The period for comment on these questions will close on June 30, 2010. On June 
2, before the comment period closes, the Commission will host a public roundtable 
at its Washington, DC Conference Center to hear from stakeholders — children’s pri- 
vacy advocates, website operators, businesses, academics, and educators and par- 
ents — on these important issues. 29 

V. Conclusion 

The Commission takes seriously the challenge to ensure that COPPA continues 
to meet its originally stated goals, even as children’s interactive media use moves 
from stand-alone PCs, to handheld devices, and potentially beyond. 

Thank you for this opportunity to discuss the Commission’s COPPA program. I 
look forward to your questions. 

Senator Pryor. Thank you. 

Mr. Sparapani? 


24 See Fed. Trade Comm’n, Implementing the Children’s Online Privacy Protection Act: A Re- 
port to Congress (2007), available at http://www.ftc.gov/reports/coppa/07COPPA Report 

to Congress.pdf. 

25 See id. at 28-29. 

26 The Commission recently concluded a series of privacy roundtables exploring the challenges 
posed by the array of new technologies that collect and use consumer data. The Commission 
also sought public comment on these issues and currently is examining the comments and infor- 
mation developed at the roundtables. In addition, the Commission expects that information 
gathered during the course of the COPPA Rule review will help inform this broader privacy ini- 
tiative. See Exploring Privacy: A Roundtable Series, http://www.ftc.gov/bcp/workshops/ 
privacy roundtables / index, shtml. 

27 Centralized authentication methods offer a means for users to log on to different services 
using one digital identity. Services such as Openld replace the common login process on indi- 
vidual websites with a single authenticated identification to gain access to multiple software 
systems. As a result, children who obtain an Openld authentication might be able to gain back- 
door access to websites that otherwise would have provided them with COPPA protections or 
prevented their entry. 

28 See Request for Public Comment on the Federal Trade Commission’s Implementation of the 
Children’s Online Privacy Protection Rule, 75 Fed. Reg. 17089-93 (Apr. 5, 2010); see also News 
Release, Fed. Trade Comm’n, “FTC Seeks Comment on Children’s Online Privacy Protections; 
Questions Whether Changes to Technology Warrant Changes to Agency Rule” (Mar. 24, 2010), 
http:/ / www.ftc.gov / opa / 2010 / 03 / coppa.shtm. 

29 See News Release, Fed. Trade Comm’n, “Protecting Kids’ Privacy Online: Reviewing the 
COPPA Rule” (Apr. 19, 2010), http:/ / www.ftc.gov / opa / 2010 / 04 / coppa.shtm. 
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STATEMENT OF TIMOTHY SPARAPANI, DIRECTOR, 
PUBLIC POLICY, FACEBOOK 

Mr. Sparapani. Chairman Pryor and Rockefeller, Ranking Mem- 
ber Wicker, and other Subcommittee members, thank you for your 
leadership and for inviting me to share Facebook’s perspective on 
child safety, and how Facebook’s innovations promote a safer on- 
line environment for teens. 

From our inception, Facebook sought to provide a safer environ- 
ment for all its users than was generally available on the Web. 
Facebook is not directed at children less than 13 years of age resid- 
ing in the U.S., and does not knowingly collect information from 
any children under 13 in the U.S. Nevertheless, we take seriously 
our responsibilities to protect children under 13 and enhance teen 
users’ online safety. 

Accordingly, Facebook was built with COPPA’s requirements in 
mind. Our commitment to keeping children off the site starts by re- 
quiring those trying to establish an account to enter their age on 
the very first screen. This birth date field prohibits children under 
13 from establishing an account. This age-gate technology places a 
persistent cookie on the device used to attempt to establish an un- 
derage account, preventing the user from attempting to modify 
their birth date. When Facebook becomes aware of accounts estab- 
lished by children under 13, we terminate those accounts and de- 
lete all information. 

We emphasize two points today. First, Facebook’s real-name cul- 
ture and innovative technologies and policies enhance online safety 
and privacy for teens. And, two, Congress should not overhaul 
COPPA, but, rather, support and encourage, not discourage or pro- 
hibit, companies’ innovations to advance child and teen online safe- 
ty, security, and privacy. 

Facebook’s approach to providing online safety leadership begins 
with the recognition that no existing system today can verify age 
of users online. As a result, Facebook developed an innovative, 
multilayer system to act as technological proxies for age 
verification. These layers are enhanced by Facebook’s real-name 
culture, which helps us identify fake accounts. 

Before Facebook, Internet users were warned to avoid sharing 
their real names and information online. Facebook was the first 
major Internet site that required people to build their profiles and 
networks using real names. This made Facebook less attractive to 
predators and other bad actors, who prefer not to use their real 
names and identities. People are also less likely to engage in nega- 
tive, dangerous, or criminal behavior when their friends can see 
their name, their speech, and their information that they’re shar- 
ing. This real-name culture, therefore, creates accountability and 
deters bad behavior. 

Since Facebook users understand that their actions are recorded 
digitally, when users violate our site rules or the law, we can pin- 
point corrective action to the specific account involved. 

Our real-name culture also empowers users to become commu- 
nity police and report violations. Facebook’s users click our report 
button, found throughout the service, when they see inappropriate 
behavior. This substantially multiplies the number of people re- 
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viewing content and behavior, which we think greatly enhances 
teen safety. 

Further, Facebook’s innovative privacy tools allow users to exer- 
cise direct control and share what they want with whom they want 
and when they want. This empowers users of all ages to protect 
themselves online. If a user feels uncomfortable connecting with a 
particular person, she may decline that friend request. If a user 
feels that a friend is annoying, harassing, or dangerous, she may 
block or de-friend that person, which terminates the user’s connec- 
tion and prevents further contact. 

Further, Facebook’s proprietary technologies allow us to continu- 
ously improve online safety and combat emerging online threats. 
Although we do not generally discuss these matters publicly, for 
fear that they may be circumvented or compromised, these tech- 
nologies allow Facebook to perform ongoing authentication checks. 
We look for behavior that does not fit the patterns created by the 
aggregate data from our 400 million users. Let me tell you that 
suspicious behavior does stand out, which initiates a Facebook in- 
quiry and immediate remedial actions. 

Facebook employs additional age-gating technologies to limit the 
contact and sharing between minors and adults; thus, reducing the 
opportunities for adults to pose as minors. 

Additionally, while those over 18 on Facebook can share informa- 
tion with everyone, Facebook automatically limits minor sharing to 
a much smaller subset of users, such as the minor’s friends, friends 
of friends, and those in their verified networks, typically in their 
schools. This substantially reduces the visibility of minors to non- 
minors whom they do not know. 

Further, Facebook recognizes the importance of collaborating 
with others to innovate in this area. We’re proud of our relation- 
ships with child and safety security experts and with law enforce- 
ment. We are particularly proud of our relationships with the attor- 
neys general. 

In conclusion, although Facebook is not a service that is directed 
at children under 13, we’ve built our service, policies, and tools 
with COPPA in mind. Our experience tells us that Congress need 
not amend COPPA, at this time. In fact, any amendments might 
undo many of our innovative privacy and safety tools. Congress 
can, however, assist companies like us in advancing online child 
and teen safety by eliminating disincentives for child safety innova- 
tion. Congress should ensure regulators are not discouraging tech- 
nological and policy safety advances when reviewing privacy and 
security policies and technologies at companies, like ours, that are 
trying to do the right thing. 

Thank you. 

[The prepared statement of Mr. Sparapani follows:] 

Prepared Statement of Timothy Sparapani, Director, 

Public Policy, Facebook 

Thank you Chairman Pryor, Ranking Member Wicker and Subcommittee Mem- 
bers. My name is Tim Sparapani and I am Director, Public Policy for Facebook. 
Thank you for inviting me to testify today concerning Facebook’s perspective on on- 
line child safety. We are pleased to discuss some of our innovations that lead to a 
safer online environment. We believe these innovations — some of which are obvious 
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to users and others that are not — are a key to providing a positive online experi- 
ence. 

Facebook started in 2004 as a social networking site for college and university 
students and from inception, Facebook sought to provide a safer environment for all 
its users than was generally available on the web. Although Facebook is not di- 
rected to young children — you must be 13 years of age or older to join Facebook- 
the Company takes special steps to insure that users under 18 have a safer experi- 
ence. 1 

Facebook has been involved with many online safety initiatives around the world, 
such as the U.S. State Attorneys General Internet Technical Task Force, the UK 
Home Office Task Force on Child Safety, the EU Safer Internet initiative, the Aus- 
tralia Attorney General’s Online Safety Working Group and others. Today, I would 
like to discuss the important ways that Facebook innovation helps promote a safer 
online environment. We also encourage Congress to encourage, not discourage or 
prohibit, companies’ innovation in policies and technologies to promote child online 
safety, security and privacy. We believe that our innovations in teen online safety, 
security and privacy advance the cause of online safety for children. 

Summary of Key Points and Request for Congressional Action 

We wish to emphasize four points today and enlist Congress’ assistance to ad- 
vance child online safety. 

• Facebook’s real name culture and innovative technologies and policies enhance 
online safety and privacy for teens. 

• Facebook expends extensive effort on key teen safety issues that further reduce 
teen risks. 

• Facebook collaborates with experts, law enforcement, and government agencies to 
develop a safer Internet. 

• Congress has a role to play to support and encourage, not discourage or prohibit 
companies’ innovations to advance child and teen online safety, security and pri- 
vacy. 

We request, therefore, that Congress not overhaul COPPA, but instead provide leg- 
islative and regulatory incentives to companies to innovate on child safety and pri- 
vacy technologies, and prevent regulators from foreclosing innovation and experimen- 
tation in this area. 

Our testimony lays out in brief a number of the key innovations employed by 
Facebook to promote safety for teens and others online. 

Facebook Innovation 1: A Real Name Culture Promotes Online Safety 

Facebook’s approach to providing online safety leadership begins with the recogni- 
tion that there is no existing system today that can verify the age of a child online. 
As a result, Facebook developed and implemented an innovative, multi-layer system 
to act as technological proxies for age. These layers are discussed in greater detail 
below and are enhanced by Facebook’s innovation of using a “real name” culture, 
which allows us to better filter out fake accounts and identify inappropriate contact. 

Before Facebook, the common wisdom was that Internet users should avoid using 
their real names and sharing information online. Facebook was the first major web 
service that required people to build their profiles and networks using real names, 
and provided them with privacy tools to enable them to decide who could access that 
information. This important policy and technical architecture decision not only al- 
lowed Facebook users to become more connected, but also made the site safer. A cul- 
ture of authentic identity made Facebook less attractive to predators and other bad 
actors who generally do not like to use their real names or e-mail addresses. 

Facebook’s real name culture also attracts users who are more likely to adhere 
to our Statement of Rights and Responsibilities (SRR, or what other companies call 
Terms of Service) and keep their behavior consistent with the standards of their 
communities. People are less likely to engage in negative, dangerous or criminal be- 
havior online when their friends can see their name, their speech and the informa- 
tion they share. The real name culture creates accountability and deters bad behav- 


1 Facebook is not directed at children less than 13 years of age residing in the United States 
and does not knowingly collect information from any children under 13 in the United States. 
Nevertheless we recognize and take seriously our responsibilities as a corporation to protect chil- 
dren and enhance the online safety of children 13 years of age and older who are our users. 
Accordingly, Facebook was built with the requirements of the Child Online Privacy Protection 
Act (COPPA) in mind. When Facebook becomes aware of accounts established by children under 
the age of 13 we terminate those accounts and delete all the information uploaded by that ac- 
count. 
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ior since Facebook users understand that their actions on our service create a record 
of their behavior. When users actions violate our SRR or the law, we can pinpoint 
corrective action — usually account termination and/or referral to law enforcement in 
potential criminal matters — to the specific account involved. Similarly Facebook is 
often able to detect fakes because of the types of connections made by a fake user 
account. And, of course, it’s difficult to connect to friends using a fake account, since 
they are more likely to reject friend requests from people they do not know. 
Facebook also routinely blocks the registration of accounts under common fake 
names. 

Our real name culture also empowers users to become “community policemen,” 
and report those whose behavior violates Facebook’s SRR. Facebook’s users regu- 
larly use our report button, found throughout the service. This substantially multi- 
plies the number of people reviewing content and behavior on Facebook and greatly 
enhances safety of teens on Facebook. At the same time, user actions often appear 
in the newsfeeds of his or her friends. If a friend learns of inappropriate behavior, 
he or she can intervene with a user to determine whether something is wrong. 

Facebook Innovation 2: User Control on Facebook Enhances Privacy and 
Safety 

Since its inception, Facebook has built innovative privacy tools for users to exer- 
cise direct control and share what they want, with whom they want, and when they 
want. This user control model supplements the protections designed into our service 
and empowers our users of all ages to protect themselves online. 

Perhaps more importantly for this hearing, Facebook’s user control model also al- 
lows users to determine whom they are connected with on Facebook. Facebook users 
must accept a request from another user to be connected — Facebook never makes 
that choice. If a user feels uncomfortable connecting with a particular person, she 
may decline that friend request. Further, if a user begins to feel that a friend on 
Facebook is annoying, spamming, harassing, and/or dangerous, she may de-friend 
that person at any time. This action of de-friending terminates the connection be- 
tween the users and prevents further contact. 2 A user may also “block” another user 
in order to prevent any contact between the two. And, any user may at any time 
use our ubiquitous report button to draw Facebook’s attention to inappropriate be- 
havior. 

Facebook takes its commitment to innovating to advance user privacy seriously. 
When new users sign up, they are introduced to our privacy help center, which ex- 
plains how they may set a privacy setting for each piece of content the user shares. 
In December 2009, we introduced an unprecedented privacy dialog, which required 
every Facebook user, worldwide, to stop and consider their privacy settings before 
they could use the service further. As a result of that process, an additional one- 
third of our users customized their privacy settings. 

Facebook Innovation 3: Hidden Security Systems and Safety Tools Advance 
Facebook Users Online Safety 

Facebook’s safety innovations extend to the development and use of proprietary 
technologies that allow us to continuously improve online safety and combat emerg- 
ing online threats. Although we do not generally discuss these publicly for fear that 
they maybe compromised or circumvented, these technologies allow Facebook to per- 
form ongoing authentication checks, including technical and community verifications 
of users’ accounts. We look for anomalous behavior in the aggregate data produced 
by our 400 million users. For example, if an adult sends an unusual number of 
friend requests to unrelated minors which are ignored or rejected, our systems could 
be triggered, sending up a red flag and initiating a Facebook inquiry and remedial 
actions. 

Facebook Innovation 4: Facebook Employs Age Gates to Limit Sharing and 
Connections Between Minors and Adults 

As stated earlier, Facebook is neither directed at children less than 13 years of 
age nor does Facebook knowingly collect information of those under 13. Our privacy 
policy is explicit in this regard: 

If you are under age 13, please do not attempt to register for Facebook or pro- 
vide any personal information about yourself to us. If we learn that we have 
collected personal information from a child under age 13, we will delete that 


2 It should be noted that the de-friending and blocking occurs without notification, so the con- 
nection is simply, elegantly, electronically severed without drawing attention to the ending of 
the connection. 
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information as quickly as possible. If you believe that we might have any infor- 
mation from a child under age 13, please contact us through this help page. 

Accordingly, Facebook is not required to comply with many of COPPA’s require- 
ments. However, Facebook actively removes accounts once discovered, of anyone it 
learns is under 13. It also employs a number of age gating technologies to limit the 
contact, sharing and connections between minors and adults. Facebook limits mi- 
nors’ access to the service by requiring those entering Facebook.com to type in their 
age on the very first screen. 3 This birth date field prohibits children under the age 
of 13 from establishing an account. The age gate technology places a persistent cook- 
ie on the device used to establish an account, preventing the user from attempting 
to modify their birth date. 

Facebook further employs a separate set of age restrictions to further limit contact 
between minors and adults. These restrictions are intended to limit opportunities 
for adults to pose as minors. Facebook engages in what we call social verification 
to ask minors that are new to our service to consider the source of a new friend 
request. Along with the friend request we may interpose a question to the minor 
prior to the minor being able to confirm that they wish to accept that request. Typ- 
ical representative questions asked of the minor: (i) Is this someone whom you know 
from your school?; or (ii) Is this someone whom you or your parents know from your 
community? We also limit the number of friend requests that anyone can send in 
a set period of time to further reduce unwanted contacts between unrelated users. 

Additional limitations further limit the sharing of data between minors and adults 
on Facebook. While those over 18 on Facebook can share information with everyone, 
Facebook automatically restricts users under 18 from doing so. Facebook automati- 
cally limits their sharing to a much smaller subset of users, such as the minor’s 
friends, friends of those friends, and their verified networks, generally associated 
with tbeir schools. This limitation substantially reduces the visibility of minors to 
non-minors whom they do not know. 

Face Book Innovation 5: Facebook Engages in Extensive Additional Safety 
Efforts to Combat Specific Threats to Teens Online 

Facebook innovations also combat specific threats to teens on our service and the 
company cooperates closely with law enforcement on these issues, upon receipt of 
appropriate legal process. 

Suicide and Self-Harm 

Facebook regularly delivers information to each user’s networks of friends. As a 
result, Facebook stands in a special position to help reduce teen suicides and other 
forms of self-harm. Users who witness changes in their friends’ behavior, reflected 
in their Facebook postings, can intervene to prevent friends from harming them- 
selves. The promotion of self-harm, including eating disorders, cutting, etc., is a vio- 
lation of Facebook’s Statement of Rights and Responsibilities, and we encourage 
users to report this information. Our dedicated team of User Operations analysts 
reviews these reports and removes content such as photos, groups, and events. 
When we receive a report of someone who has posted suicidal content on Facebook, 
we alert the National Suicide Prevention Lifeline and encourage the user to contact 
his or her local authorities/law enforcement immediately. We’ve also posted an FAQ 
to the privacy and safety page in our Help Center with information and links to sui- 
cide help resources. Facebook saves lives on a regular basis by helping to prevent 
this kind of behavior. Our real name culture helps people identify those who are 
truly in need and respond in real time to a cry for help. 

Cyberbullying and Harassment of Teens Online 

Facebook has led efforts around the world to help combat cyberbullying. In the 
U.S., Facebook was a founding member of the Stop Cyberbullying Coalition. Our ro- 
bust reporting infrastructure leverages Facebook’s 400 million users to monitor and 
report offensive or potentially dangerous content. This infrastructure includes, sys- 
tems to prioritize the most serious reports, and a trained team of reviewers wbo re- 
spond to reports and escalate them to law enforcement as needed. The team treats 
reports of harassing messages as a priority, reviewing and acting on most within 
24 hours. We also prioritize serious reports submitted through the contact forms in 
our Safety Center. With assistance from our outside experts on our Safety Advisory 
Board we have produced new materials on our Safety Center that specifically ad- 
dress how to prevent or respond to cyberbullying. We have also partnered with 


3 The Subcommittee should note that many other leading online companies and social net- 
works never even attempt to collect users’ date of birth, and, therefore, never even attempt to 
block minors from using their sites and services. 
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other organizations like MTV on their “A Thin Line” campaign to educate young 
people about the dangers of digital abuse; with the BBC on their “bullyproof’ cam- 
paign, and regularly invite experts, such as the National Crime Prevention Council 
to address cyberbullying on the Facebook Blog, which reaches over 8 million people. 

Missing Children and Runaways 

Facebook has also been successful in helping to locate missing teens. Law enforce- 
ment has generously praised Facebook for prioritizing law enforcement requests for 
IP location information that might help locate a missing child, which we provide on 
receipt of appropriate legal process. In just 1 week last February, we helped authori- 
ties in Fairfax, Virginia and Menlo Park, California find and return two missing 
kids. Last July, we received a request for IP data and basic user information for 
a minor who had gone missing. Over the course of the next week, we worked closely 
with law enforcement over e-mail and by telephone. Ultimately, the minor was 
found using the exact IP data we had provided. Similarly, a Facebook user went 
missing in Canada, and a demand for ransom was made. The Royal Canadian 
Mounted Police contacted us, and we followed our procedure for imminent threats. 
When a message was sent to a friend from the missing person’s account, we pro- 
vided the necessary data, enabling the RCMP to locate and return the person to 
safety. 

Preface: only a tiny fraction of a single percent of users will ever encounter the fol- 
lowing two kinds of behaviors on Facebook. We focus on these areas because we take 
any threat to our users’ safety very seriously. 

Registered Sex Offenders Attempting to Establish Accounts 

Although it is not required to do so by law, Facebook prohibits access to Facebook 
by Registered Sex Offenders (RSOs). Facebook employs an outside contractor — at 
our own expense — to collect a list of RSOs from all of the states periodically 
throughout each year. Every state and locality keeps their list of RSOs in a different 
file format with different information and different character fonts, etc. We periodi- 
cally compare that compilation of names to our user list; we do not wait for law en- 
forcement to request that we do so. Our internal team of investigation professionals 
evaluates any potential matches more fully. If we find that someone on a sex of- 
fender registry is a likely match to a user on Facebook, we notify law enforcement 
and disable the account. On occasion, law enforcement has asked us to leave the 
accounts active so that they may investigate the user further. 

We have worked proactively to establish a publicly available national database of 
registered sex offenders that enables real-time checks and includes important infor- 
mation like e-mail addresses and IM handles. 

Child Pornography 

Facebook takes substantial steps to stop any trafficking of child sexual exploi- 
tation materials, commonly referred to as child pornography. We use automated 
tools to automatically prohibit any sharing of known links (i.e., URLs) containing 
these materials so that these links cannot be distributed across our service. 
Facebook has a highly trained team dedicated to responding to the rare occasions 
when child pornography is detected on the service. That team sends incident reports 
to the National Center for Missing and Exploited Children (NCMEC) and the U.S. 
Department of Justice for potential prosecution. When we encounter what we be- 
lieve are new offending URLs, we deploy a new technology we have developed that 
enables us to pull down any URL shared throughout our service even though it has 
been distributed. 

Facebook Innovation 6: Facebook Has Made a Commitment to Collaborate 
on the Advancement of Safety Online 

Although Facebook has important responsibilities in advancing safety online, 
Facebook recognized the importance of collaborating with others to innovate in this 
area. Facebook has developed deep, ongoing relationships with child safety and se- 
curity experts. In December, Facebook formalized these relationships by creating a 
Safety Advisory Board of outside experts who advise us, and, on occasion, our users 
about how to keep teens safe online. Facebook also continues to work closely with 
law enforcement agencies around the country, and around the world. We are par- 
ticularly proud of our work with the States’ Attorneys General. In 2008, Facebook 
actively participated in the Internet Safety Technical Task Force at the behest of 
the Attorneys General to examine these issues. In April, we launched our new Safe- 
ty Center to provide our users, parents and educators with updated educational ma- 
terials and information about how to utilize our innovative privacy and security 
tools to enhance online safety. 



19 


Conclusion: Facebook Will Continue to Innovate but Congress must Help 

Although we are not a service that is directed at children less than 13 years of 
age, we have built our service, policies, and tools with COPPA in mind. Our experi- 
ence tells us that Congress need not amend COPPA at this time. In fact, any 
amendments might undo many of our innovative privacy and safety tools. Congress 
can, however, assist Facebook and companies like us in advancing online child and 
teen safety by providing incentives, not disincentives, for child safety innovation on- 
line. If COPPA is amended, Congress could consider permitting companies to ex- 
plore innovative approaches to obtaining parental consent online. Congress should 
ensure regulators are not discouraging technological and policy innovation in this 
area when reviewing privacy and security policies of companies that are trying to 
do the right thing. 

We thank this subcommittee for its leadership and call on Congress to take these 
actions to enhance child online safety. Thank you for your consideration. 

Senator Pryor. Thank you. 

Mr. Hintze? 

STATEMENT OF MICHAEL D. HINTZE, ASSOCIATE GENERAL 
COUNSEL, MICROSOFT CORPORATION 

Mr. Hintze. Chairman Rockefeller, Chairman Pryor, Ranking 
Member Wicker, thank you for the opportunity to share Microsoft’s 
views on the Children’s Online Privacy Protection Act. 

Microsoft has a deep and long-standing commitment to pro- 
tecting the privacy of consumers, including children, who use our 
software and services. I want to begin by discussing Microsoft’s 
comprehensive approach to protecting children’s privacy online. I 
will then identify those areas where COPPA has made progress 
over the last decade, and highlight a couple of key challenges that 
remain. 

This hearing is timely. Ten years ago, this month, the Federal 
Trade Commission’s COPPA rule took effect. COPPA’s stated goal 
is to preserve the interactivity of children’s experience on the Inter- 
net, while protecting their privacy. That goal remains essential 
today. Research has found that children gain important educational 
and social benefits, such as increased opportunities for learning 
and creativity, by engaging in interactive activities online. And 
children are realizing these benefits as they increasingly use new 
technologies to access the Internet, including mobile phones, 
videogame consoles, and portable media players. But, as we all rec- 
ognize, these interactive technologies often enable consumers to 
disclose personal information online, and children may not fully un- 
derstand the terms or the tradeoffs involved. 

COPPA was designed to address this issue. Microsoft fully sup- 
ports COPPA’s objectives of enhancing parental involvement and 
protecting children’s privacy. 

While children’s use of the Internet has evolved over the last dec- 
ade, these objectives remain just as, if not more, important today. 
Privacy failures can have a real impact on children’s safety. 

Therefore, Microsoft takes a number of steps to help protect chil- 
dren’s privacy and safety through our own products and services, 
educational initiatives, and partnerships. 

First, Microsoft requires parental consent and offers parental 
controls for a number of our products and services, including Xbox, 
Hotmail, and our Instant Messenger Service. For example, our 
Windows Live Family Safety tool enables parents to limit their 
children’s searches, block or allow websites based on the type of 
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content, restrict with whom the child can communicate, and access 
detailed activity reports that show the websites their children vis- 
ited, and the games and applications they used. 

Second, Microsoft engages in educational efforts around the 
world to help parents and caregivers make informed decisions 
about children’s Internet use. 

Third, Microsoft partners with government officials, industry 
members, law enforcement agencies, and child advocates, to ad- 
dress children’s privacy and safety issues. 

The attachment to my written testimony provides more details 
on these initiatives. 

Now I’d like to spend a few minutes talking about COPPA. 

In the past decade, COPPA has made important progress in rais- 
ing awareness of children’s privacy issues. For example, many 
website operators now limit the amounts and types of information 
they collect from children, and provide parents and children with 
educational resources to foster conversations about online privacy 
and safety. Also, by encouraging website operators to be more 
transparent about their privacy practices, and encouraging them to 
implement parental consent mechanisms, COPPA has enabled par- 
ents to take a more active and informed role in deciding how their 
children can take advantage of the Internet’s many benefits. 

We believe COPPA provides a flexible notice-and-consent frame- 
work that can accommodate children’s evolving use of new tech- 
nologies. Therefore, we do not believe that a legislative amendment 
is necessary at this time. Rather, the statute enables the FTC to 
update its rule. And we appreciate the FTC’s efforts to review its 
implementation of COPPA in light of new business models and new 
technologies. 

I’d like to highlight two aspects of the FTC’s rule that we urge 
the Commission to consider as part of its review. 

First, the Commission should provide clear guidance on how com- 
panies can better meet, not only the letter, but the spirit of the 
law. Microsoft goes beyond the letter of the law by proactively re- 
questing age information and seeking parental consent for chil- 
dren’s use of many of its services, even when those services are not 
specifically targeted to children. We take this approach to encour- 
age parental involvement in children’s online activities, and enable 
children to participate in, and benefit from, interactive activities 
online. Other companies take different approaches. We encourage 
the Commission to use its COPPA rule-review process as an oppor- 
tunity to help website operators and online services understand 
how they can honor the spirit of COPPA, especially in light of new 
technologies. 

Second, we urge the Commission to work with technology compa- 
nies and consumer advocates to develop more consumer-friendly, 
effective, and scalable methods for obtaining parental consent. The 
FTC has explicitly approved five parental consent methods for the 
disclosure of children’s information online. However, these methods 
can be cumbersome for parents, do not scale for widely used serv- 
ices, and rely on children’s self-reporting of age. These issues be- 
come more pronounced as children increasingly access services 
through mobile devices, where providing notice and obtaining pa- 
rental consent raise additional challenges. 
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Microsoft recognizes that the task of improving the parental con- 
sent process is not easy, and there’s no silver-bullet solution. The 
FTC’s ongoing COPPA rule review provides a good opportunity for 
productive dialogue on alternative parental consent methods. We 
are committed to working, both in the short and long term, with 
Congress, the Commission, and other stakeholders to address pri- 
vacy challenges raised by new technologies. 

Thank you for the opportunity to testify today. 

[The prepared statement of Mr. Hintze follows:] 

Prepared Statement of Michael D. Hintze, Associate General Counsel, 
Microsoft Corporation 

Chairman Pryor, Ranking Member Wicker, and honorable members of the Sub- 
committee, thank you for the opportunity to share Microsoft’s views on children’s 
privacy issues raised by new technologies and the Children’s Online Privacy Protec- 
tion Act (COPPA). Microsoft has a deep and long-standing commitment to protecting 
the privacy of consumers, including children, who use our software and services. We 
appreciate your initiative in holding this hearing today. 

This hearing is timely. Ten years ago this month the Federal Trade Commission’s 
COPPA Rule took effect. At the time, COPPA’s stated goal was to preserve “the 
interactivity of children’s experience on the Internet.” 1 That goal remains essential 
today. Research has found that children gain important educational and social bene- 
fits, such as increased opportunities for learning and creativity, by engaging in 
interactive activities online. 2 And children are realizing these benefits as they in- 
creasingly use new technologies to access the Internet, including mobile phones, 
video game consoles, and portable media players. 3 

But, as we all recognize, these interactive technologies often enable consumers to 
disclose personal information online, and children may not fully understand the 
terms or the trade-offs involved. COPPA was designed to address this issue. Micro- 
soft fully supports COPPA’s objectives of enhancing “parental involvement in a 
child’s activities” and protecting “children’s privacy by limiting the collection, [use, 
and disclosure] of personal information from children without parental consent.” 4 
While children’s use of the Internet has evolved over the last decade, these objec- 
tives remain just as — if not more — important today. Privacy failures can have a real 
impact on children’s safety. Therefore, Microsoft has developed strong privacy prac- 
tices regarding how children’s personal information is collected, used, and disclosed 
online. 

Today, I want to begin by discussing Microsoft’s comprehensive approach to pro- 
tecting children’s privacy online. I then will identify those areas where the COPPA 
Rule has made progress over the last decade and highlight a couple of key chal- 
lenges that remain. My testimony concludes by describing promising identity man- 
agement and privacy enhancing tools that can help address these challenges. 

Microsoft’s Comprehensive Approach to Addressing Children’s Privacy 

Microsoft takes a number of steps to help protect children’s privacy and safety 
through our own products and services, educational initiatives, and partnerships. 

First, Microsoft requires parental consent and offers parental controls for a num- 
ber of our products and services. For example, our Xbox Live, Spaces, Messenger, 
and Hotmail services request age information in a neutral manner during the reg- 
istration process. If a child indicates he or she is under the age of 13, we seek and 


1 144 Cong. Rec. S12787 (1998) (statement of Sen. Bryan); see also 64 Fed. Reg. 59888, 59889 
(1999) (“In drafting this final rule, the Commission has taken very seriously the concerns ex- 
pressed about maintaining children’s access to the Internet.”). 

2 See, e.g., Carly Shuler, Joan Ganz Cooney Center at Sesame Workshop, Pockets of Potential: 
Using Mobile Technologies To Promote Children’s Learning 13—14, App. A, B (2009), http:! / 
www.joanganzcooneycenter.org/pdf/pocketsofpotential.pdf; National School Boards Association, 
Creating & Connecting: Research and Guidelines on Online Social — and Educational — Net- 
working 1 (July 2007), http:/ lwww.nsba.org/SecondaryMenu/TLN / CreatingandConnecting 
.aspx. 

3 According to the Henry J. Kaiser Family Foundation, children 8- to 10-years old spend about 
30 minutes each day browsing websites, posting to social networking sites, and sending instant 
messages and e-mails to friends and family. This number more than doubles for older children. 
See Henry J. Kaiser Family Foundation, Generation M 2 : Media in the Lives of 8- to 18-year- 
olds 20 (2010), http. j / www.kff.org / entmedia / upload / 8010.pdf '. 

4 144 Cong. Rec. S12787 (1998) (statement of Sen. Bryan). 
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obtain parental consent before the child is permitted to participate in interactive ac- 
tivities offered by these services. 

In addition, our parental controls for Windows 7, Windows Live, Xbox 360, Zune, 
and other services help parents make granular choices about how their children 
may share personal information online. For example, our Windows Live Family 
Safety tool enables parents to limit their children’s searches; block (or allow) 
websites based on the type of content; restrict whom their children can communicate 
with in Windows Live Spaces, Messenger, or Hotmail; and access detailed activity 
reports that show the websites their children visited and the games and applications 
they used. 5 Importantly, we have designed our family safety settings such that the 
settings can roam across different types of devices through which children may ac- 
cess these online services. 

Second, Microsoft engages in educational efforts around the world to encourage 
parents and caregivers to talk to their children about online privacy and to assist 
them in making informed decisions about their children’s Internet use. For example, 
Microsoft provides parents with a number of educational resources to help them pre- 
serve their children’s privacy and protect their children from inappropriate content, 
conduct, and contact online. 6 And Microsoft works to raise awareness of children’s 
privacy and safety issues by sponsoring roundtables with local and regional policy- 
makers, academics, the media, and other thought leaders. 

Third, Microsoft partners with government officials, industry members, law en- 
forcement agencies, and child advocates to address children’s privacy and safety 
issues. For example, we support GetNetWise.org, which offers parents and children 
resources for making informed decisions about Internet use. We also are an active 
participant in the National Cyber Security Alliance and its online website Stay Safe 
Online, which encourages children and parents to discuss topics such as disclosing 
personal information through Internet chat rooms, e-mail, and websites. In addition, 
Microsoft works closely with the International Center for Missing and Exploited 
Children, Interpol, the National Center for Missing and Exploited Children, and 
many other organizations on child protection issues. 7 

The COPPA Rule 10 Years Later 

In the past 10 years, the FTC’s COPPA Rule has made important progress in rais- 
ing awareness of children’s online privacy issues. For example, many website opera- 
tors now limit the amounts and types of personal information they collect from chil- 
dren online and provide parents and children with educational resources to foster 
conversations about online privacy and safety. Also, by encouraging website opera- 
tors to be more transparent about the types of personal information that they collect 
from children online and about the use and disclosure of this information, the 
COPPA Rule has enabled parents to take a more active and informed role in decid- 
ing how their children can take advantage of the Internet’s many benefits. 

We appreciate the FTC’s efforts to review its implementation of COPPA in light 
of changes in technology, and Microsoft looks forward to participating in this proc- 
ess. While we recognize that changes to the COPPA Rule may be warranted, we do 
not believe that a legislative amendment is necessary at this time. COPPA provides 
a flexible notice and consent framework for the collection, use and disclosure of chil- 
dren’s personal information, and we believe the statute enables the FTC to update 
its Rule as technologies and children’s use of new technologies evolve over time. 

Today, I want to highlight two key aspects of the FTC’s Rule that we believe the 
Commission should consider as it reviews its Rule in light of new technologies. 

First, we hope that the Commission will provide clear guidance on how companies 
can better meet not only the letter, but also the spirit, of the law in light of chang- 
ing technologies and the evolving ways in which children are consuming online serv- 
ices. As expected, website operators and online services have adopted different ap- 
proaches to complying with the COPPA Rule. 8 For example, Microsoft proactively 
requests age information and seeks parental consent for children’s use of many of 
its services even when those services are not specifically targeted to children. We 
take this approach in order to encourage parental involvement in children’s online 
activities and enable children to participate in and benefit from interactive activities 


5 See Attachment. Because we believe that consumers should be notified that they are being 
monitored to prevent abuse, children are provided on-screen notice where these tools provide 
parents with monitoring capabilities and these capabilities are engaged. 

6 See, e.g., http://www.microsoft.com/protect/family. 

1 See, e.g., http://www.microsoft.com/protect/community.aspx; Microsoft Corp., PhotoDNA: Put- 
ting Microsoft Technology To Work Ensuring a Childhood for Every Child. (2009), http:/ / 
www.microsoftphotodna.com / . 

8 Microsoft supports, for example, the FTC’s approach of treating operators of general audience 
sites differently from operators whose sites are directed to children. 
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online. Other companies take different approaches. While flexibility in implementing 
the requirements of COPPA is desirable given the diverse array of websites and on- 
line services available, new technologies challenge COPPA’s goal of promoting op- 
portunities for discussions between parents and children about the disclosure of per- 
sonal information online. We encourage the Commission to use its COPPA Rule re- 
view process as an opportunity to help website operators and online services under- 
stand how they can honor the spirit of COPPA, especially in light of new tech- 
nologies. 

Second, we urge the Commission to work with technology companies and con- 
sumer advocates to develop more consumer-friendly, effective, and scalable methods 
for obtaining parental consent. The COPPA Rule generally requires that website op- 
erators and online services obtain verifiable parental consent before knowingly col- 
lecting, using, or disclosing children’s personal information online. 9 The FTC has ap- 
propriately adopted a “sliding scale” approach to parental consent. However, the 
FTC has only explicitly approved five parental consent methods for the disclosure 
of a child’s personal information online: (1) providing a form for the parent to print, 
sign, and mail or fax back to the company; (2) requiring the parent to use a credit 
card in connection with a transaction; (3) maintaining a toll-free telephone number 
staffed by trained personnel for parents to call; (4) obtaining a digital certificate 
using public key technology; and (5) requiring an e-mail accompanied by a PIN or 
password obtained through one of the first four verification methods. These methods 
can be cumbersome for parents, do not scale for large organizations, and rely on 
children’s self-reporting rather than an online age verification system. 10 These 
issues become more pronounced as children increasingly access online services 
through mobile devices, where providing notice and obtaining parental consent 
raises additional challenges. 

For this reason, Microsoft recommends that the Commission expand its list of ap- 
proved parental consent methods to include other reliable approaches that minimize 
burdens on parents, leverage existing technologies, and scale for millions of users. 
In addition, as more online services are made available on mobile phones and other 
mobile devices, the Commission should consider the types of parental consent mech- 
anisms appropriate for these devices. 

Microsoft recognizes that the task of improving the parental consent process is not 
easy and that there is no “silver bullet” solution. But the FTC’s ongoing COPPA 
Rule review provides a good opportunity to begin a productive dialogue on how to 
take advantage of existing services and new technologies to develop alternative pa- 
rental consent methods. 

For example, Microsoft and others in the industry have been working on new 
technologies for authentication and identity management generally, and these tech- 
nologies could be used to help streamline and make more effective parental consent 
processes. 11 Digital identity cards are one of these technologies. They could be 
issued through existing offline processes where in-person identity verification of a 
parent-child relationship already occurs. Once a digital identity card has been 
issued, website operators and online service providers could obtain parental consent 
by requesting that parents and children provide their digital identity cards before 
accessing interactive services and features. 

Microsoft appreciates that these stronger authentication and online identity tech- 
nologies can themselves impact privacy. For this reason, we believe that these sys- 
tems should work in tandem with technologies that enable users to limit the per- 
sonal information they disclose. For instance, Microsoft is working on technology 
that relies on cryptographic protocols and tokens to enable parents and children to 
better manage their identities online in a privacy enhancing way. When combined 
with the use of digital identity cards, these technologies could allow parents and 
children to disclose only that information that is necessary (such as parental status 
or age, but not name or other personal information) to enable children’s access to 
and use of websites and online services. 12 

These identity management technologies offer exciting prospects for creating a 
broader range of meaningful parental consent methods tailored to the use of chil- 


9 16 C.F.R. §312.5. 

10 Children in the upper age range covered by COPPA may be sophisticated enough to provide 
false age information in order to access online sites and services that screen for age. 

1 1 See Microsoft Corp., Digital Playgrounds: Creating Safer Online Environments for Children 
(2008), http .7 / download.microsoft.com / download / 2/8 14 / 284093 f4-5058-4a32-bfl3-cl2e2320cd 
73 / Digital%20Playground.pdf Scott Charney, Vice President Trustworthy Computing, Micro- 
soft, "The Evolution of Online Identity,” 7 IEEE Security and Privacy 56—59 (2009). 

12 Microsoft Corp., Microsoft U -Prove Technology Release: Open Standards and Community 
Technology Preview (2010), http://www.microsoft.com/mscorp/twc/endtoendtrust/visionl 
uprove.aspx. 
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dren’s information online. Microsoft looks forward to working in close collaboration 
with the public sector and other industry members to evaluate and implement these 
technology tools as part of a comprehensive approach to protecting children’s privacy 
online. 

Conclusion 

Thank you for the opportunity to testify today. We take our privacy obligations 
seriously, and we are committed to working in both the short and long term with 
Congress, the Commission and other stakeholders to address privacy challenges 
raised by new technologies. 


Attachment 


Family Safety 

Helping to Protect Children in the Online World 

This white paper is for informational purposes only. Microsoft Makes No Warran- 
ties, Express or Implied, in this Document.® 2008 Microsoft Corp. All rights re- 
served 

Introduction 

For children, the Internet is both a classroom and a virtual playground — a place 
to learn, connect with friends and have fun. But as kids explore and interact online, 
they might encounter content their parents would not want them to see, or they 
might come into contact with people who pose a threat to them. Just as there are 
places and activities in the physical world that are unsafe or inappropriate for chil- 
dren, there are places and activities online that can pose a risk to children’s privacy 
and personal safety. 

In the United States, 71 percent of teens with online access have a social net- 
working profile. 1 Half of all British children aged 12 to 18 use instant messaging. 2 
Among Australian children who use the Internet, 75 percent visit video-sharing 
websites and 95 percent play games online. 3 In Brazil, 98 percent of children with 
online access download music. 4 Children don’t always apply the common-sense per- 
sonal boundaries and social mores of the offline world to their online experiences. 
In this context, today’s parents consider the Internet the greatest risk to their chil- 
dren among all types of media, according to one study. 5 

Parents and caregivers are in the best position to make decisions about what is 
appropriate for children and to talk to them about online safety. But they need help, 
particularly through tools and guidance. Microsoft has invested significantly in fam- 
ily safety online, incorporating family safety features into a broad range of Microsoft 
products and services that are available for consumer use. At the same time, we 
have made extensive efforts — often in collaboration with child development experts 
and non-profit partners — to provide guidance and education for teachers, parents 
and children. We also work with law enforcement, industry partners and govern- 
ments to combat Internet crime and to strengthen legislation that protects children 
from online exploitation. 

Making the Internet safer for children aligns with Microsoft’s overall commitment 
to increasing trust and safety online and to protecting consumer security and pri- 
vacy. (See sidebar on page 2.) Our efforts to promote family safety in the digital 
world fall into three key areas: 

• Tools and technology. Microsoft offers family safety settings and parental con- 
trols in Windows Vista®, Windows Live™, Xbox 360®, Xbox LIVE®, Zune® 
and other products and services. We are also an industry leader in developing 
interoperable technologies for identity management and tools that independent 
software vendors can use to extend the safety capabilities of the Windows Vista 
platform. 


1 Cox Communications Teen Internet Safety Survey, Wave II — in Partnership with the Na- 
tional Center for Missing & Exploited Children (NCMEC) and John Walsh, March 2007. http :/ / 

www.cox.com / TakeCharge / includes / docs / survey results 2007. ppt. A social networking profile 

is a user’s personal page on a social networking website. Profiles often include information about 
the person, photos, videos, personal blogs and contact information. 

2 “A European Research Project: The Appropriation of New Media by Youth.” Mediappro, 2006. 
http:/ / www.mediappro.org / publications / finalreport.pdf . 

3 “Norton Online Living Report. Symantec, 2008. http:/ / www.symantec.com / content !en lust 

home homeoffice / media / pdf 7 nolr / 080214 a us norton online living report nolr- 

fi.nal.pdf. 

4 Ibid. 

5 Common Sense Media Parents Study, Insight Research Group, May 19, 2006. http. ‘II 
www.commonsensemedia.org / news / CS-Parent-Study. PPT. 
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Guidance and education. Microsoft works with governments, nonprofits and com- 
munity organizations to help parents and children better understand online risks 
and how to reduce them. These efforts range from informational websites and Inter- 
net safety curricula to public-information campaigns. 

Law enforcement and public policy. Microsoft works with law enforcement agen- 
cies and other partners to offer tools and training that aid law enforcement efforts 
to apprehend and prosecute criminals who use the Internet to harm children. We 
also support government efforts to craft and enact effective public policies that help 
protect Internet users and penalize online criminals. 

Security and Privacy at Microsoft 

Consumer security and safety are a top priority for Microsoft. Six years ago, the 
company launched its Trustworthy Computing Initiative, a company-wide top-to-bot- 
tom commitment to delivering secure, private and reliable computing experiences 
for everyone. In addition to improved software development practices, Trustworthy 
Computing includes support for strong laws addressing criminal online conduct; 
support for law enforcement training, investigations, coordination and prosecutions; 
and guidance for customers on adopting security and privacy best practices. 

Our corporate privacy policies — including a set of privacy principles released in 
2007 related to search and online advertising — reflect our long-held commitment 
that consumers should have the ability to control the collection, use and disclosure 
of their personal information. 6 This is nowhere more crucial than in the area of 
young people’s Internet use. From social networking sites to e-mail to online gam- 
ing, responsible user practices and technology safeguards must be applied to help 
keep young Internet users — and their personal information — safe. 

Technology 

When it comes to children’s safety online, there is no technological silver bullet 
that can substitute for parental involvement, supervision and guidance. But Micro- 
soft is committed to developing tools and technologies that can help parents in this 
important task. Family safety tools and features have been built into a wide range 
of Microsoft products and services, including Windows Vista, Windows Live, Xbox 
360, Xbox LIVE, Zune and Mediaroom™. 7 These include tools that give parents 
greater control over what their children can access and how they can interact via 
the Web and elsewhere online — from Web content filtering and e-mail contact man- 
agement to social networking restrictions. 

Windows Vista 

In all home editions of Windows Vista, Microsoft’s next-generation client oper- 
ating system, separate accounts can be created for each member of the family. 8 And 
using the centralized Parental Controls panel, parents can specify when their chil- 
dren can use the computer, which websites they can visit and which software appli- 
cations they can use. Parents can also restrict access to PC software games based 
on title, content or rating. They can even view detailed reports about a child’s com- 
puter use to look for potentially inappropriate sites that the child might be visiting. 

Monitoring children’s computer use not only helps parents keep track of what 
their kids are seeing, hearing and doing, but it enables them to refine and modify 
restrictions based on actual feedback and offers a basis for informed discussion with 
their kids about Internet use and online habits. The Parental Controls icon in the 
system tray is always visible to let children know that the Parental Controls feature 
is on. 

For Web content filtering, parents can create customized settings that block sites 
by type of content (such as mature content, pornography or sex education) or specifi- 
cally allow only certain sites. Parents can also enable a setting that prevents chil- 
dren from downloading software. 


6 Details on Microsoft’s privacy policies are available at http:/ 1 privacy.microsoft.com I . 

7 More information on these and other family safety technologies can be found at 
www.microsoft.com / protect . 

8 The Starter, Home Basic, Home Premium and Ultimate editions. 
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To restrict the amount of time kids spend using the computer, parents can use 
a simple point-and-click grid to indicate “blocked” and “allowed” days of the week 
and hours of the day. As the end of an approved time period approaches, the child 
receives a 15-minute and a 1-minute notification. If the allotted time ends before 
the child logs off, Windows Vista suspends the session and saves all of the child’s 
work. 

From the Windows Vista Parental Controls panel, users can also enable safety 
features — such as content filters — that are built into third-party software and serv- 
ices. 9 Microsoft also offers application programming interfaces (APIs) so third-party 
developers can build to the Windows Vista platform. 


9 Windows Vista Parental Controls are configured to turn themselves off to prevent conflicts 
with third-party family safety applications. 
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Windows Media Center 

Windows Media Center in Windows Vista Home Premium and Ultimate editions 
is a feature that allows you to watch and record live TV on your computer. It in- 
cludes Parental Controls that let parents restrict viewing of digital entertainment 
by industry ratings (including the Motion Picture Association of America). Parents 
can: 

• Set a maximum allowed rating for television and movie content (such as PG- 
13 or TV-14) 

• Restrict access to unrated programming 

• Block access to programming based on category: fantasy violence, suggestive 
dialogue, offensive language, sexual content or violence 

Windows Live 

Windows Live (http: I / get.live.com) is a set of free Web services and PC applica- 
tions that help people stay better connected and get the most out of their Windows 
experience. It includes the Windows Live Hotmail e-mail client, social networking 
with Windows Live Spaces, instant messaging with Windows Live Messenger and 
other services. 
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A key offering of Windows Live is Windows Live OneCare™ Family Safety , a serv- 
ice that seamlessly integrates family safety options for Windows Live services. Fam- 
ily Safety offers adjustable content filtering, activity reports for each user in the 
family, and contact management features to help prevent children from interacting 
with unknown individuals. Parents can monitor online activity and update settings 
from any Internet-connected computer. 

Family Safety also includes expert guidance for parents on age-appropriate set- 
tings. For certain markets, this guidance is country-specific. For example, the U.S. 
version of Family Safety includes guidance from the American Academy of Pediat- 
rics; in Germany, the guidance is from Deutsches Kinderhilfswerk. 

Family Safety can be used with Windows XP SP2 and later versions of the Win- 
dows® operating system, and it supports Windows Internet Explorer® 6 and later 
versions, as well as other browsers. Key elements of the service include: 

Contact management. Online contact with strangers is a significant concern for 
parents because of the potential for harassment, inappropriate online interaction 
and contact with predators. Parents can specify that their approval be required be- 
fore their child can communicate with a new person using Windows Live services 
such as Windows Live Hotmail and Messenger or before a new person is allowed 
to see the child’s social networking page or blog on Spaces. The contact-management 
settings apply even when a child logs on to Windows Live from a computer outside 
the home. 

• Content filtering. Parents can specify unique filtering settings for each member 
of the family. These settings allow, block or display a warning for a range of 
content categories, which apply to all Web content viewing. Filtering guidance 
helps parents determine age-appropriate settings and online activities as well 
as how to talk to children about safe Web browsing practices. 

In addition, abuse reporting is available throughout Windows Live and the MSN* 
network of Internet services so users can report inappropriate behavior or content. 10 

Other major Windows Live services also have their own specific safeguards and 
privacy tools. They allow users to do the following: 

Live Search 

• Filter search results for sexually explicit images and text 


10 For example, there is a Report Abuse button at the bottom of every Windows Live Space 
so customers can easily report issues. 
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Windows Live Messenger 

• Create a manually selected list of allowed instant messaging contacts 

• Be notified whenever someone tries to add you to their Messenger Contacts list 

• Block a person from contacting you or seeing if you are online 
Windows Live Hotmail 

• Set your personal account filters so Windows Live Hotmail will deliver mail 
only from people on your Contacts list and trusted senders 

• Block all e-mail from a particular e-mail address 

• Identify, based on color-coded alerts, whether an incoming message might be 
malicious or fraudulent 

Windows Live Spaces 

• Make your Windows Live Space completely private, available only to selected 
people, or public 

• Access safety information from any Spaces page 
Xbox 360 and Xbox LIVE 

Xbox 360 and Xbox LIVE — Microsoft’s gaming platform and online gaming envi- 
ronment, respectively — are designed to provide secure gaming and age-appropriate 
content for all users. The easy-to-use Family Settings console in Xbox 360 allows 
parents to set restrictions that apply to both offline and online play. 



The console recognizes game and video rating systems from countries around the 
world, allowing parents to specify categories of games and movies their children can 
access. 11 It also has a Family Timer feature that parents can use to limit the dura- 
tion of game play within each 24-hour period. 

For Xbox LIVE, the console can be configured to allow online gaming and commu- 
nication only with approved friends and to require parental approval for new 
friends. It also allows users to report inappropriate use of the service. 

Specifically, the Xbox 360 Family Settings console allows parents to: 

• Customize each child’s playing environment 

• Specify how much time a child can spend playing games each day or each week 

• Specify which games a child can play, based on game rating 


11 Systems for rating age-appropriateness of video and game content vary by country or by 
region. They include the Entertainment Software Rating Board ( www.esrb.org ) in the United 
States and Canada, the British Board of Film Classification iwww.bbfc.co.uk) in the UK, the 
Game Rating Board iwww.grb.or.k) in Korea, Unterhaltungssoftware Selbstkontrolle 
iwww.usk.de) in Germany, and Pan-European Game Information iwww.pegi.info ) in much of Eu- 
rope. 
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• Override parental restrictions on a case-by-case basis 

• Create personal Xbox LIVE settings for a child that will apply to that account 
no matter what machine is used to access the account 

• Require parental approval of each child’s list of online friends 

• Specify which types of online communication are allowed (i.e., text and voice, 
video) 

• Limit exposure to content created by other members of the Xbox LIVE commu- 
nity 

• Limit sharing of personal profile information to friends only, or block all shar- 
ing of personal profile information 

Mediaroom 

Microsoft Mediaroom, the latest version of Microsoft’s Internet Protocol Television 
(IPTV) software platform, allows cable operators and telecommunication companies 
to deliver content and services such as standard and high-definition TV channels, 
digital video recordings and video on demand. 

Mediaroom includes parental control features for managing children’s access to 
channels, shows and services. Using a PIN or multiple PINs, parents can restrict: 

• Access to programming by rating (with special functionality for blocking adult- 
rated programming) 

• Access to unrated programming 

• Access to individual channels 

• The ability to purchase video-on-demand and other content 
Zune 

Parents can use Family Settings to restrict their children’s access to and ability 
to purchase content from the Zune Marketplace online music store for use on their 
Zune portable media player. Specifically, parents can: 

• Specify whether a child can make purchases from Zune Marketplace. 

• Restrict a child’s access to explicit content available through Zune Marketplace. 

• Specify who can send messages to a child in the Zune Social online community. 
(Children 12 and under are prohibited from joining the community.) 

• Specify whether a child can accept friend requests in the Zune Social online 
community. 

• Specify whether a child can share favorite artists and songs with the Zune com- 
munity. 

• Specify who can see a child’s friends list. 

Guidance and Education 

While Microsoft continues to create tools and technologies to help promote child 
safety on the Internet, we believe that educating parents and children is the most 
effective way to respond to online risks. To this end we support numerous family 
safety educational organizations and outreach efforts, including: 

• Ad Council’s Internet Safety Coalition (ISC). Microsoft is a member of the ISC, 
which is working to help kids understand that the Internet is a public place and 
to explain the risks of ill-considered Internet posting. 

• Bad Guy Patrol. As part of Microsoft Canada’s and the Government of Alberta 
Children’s Services shared commitment to preventing child sexual exploitation, 
www.badguypatrol.ca teaches children ages 5-10 critical Internet safety skills 
through a series of games. A section for adults provides additional tips on how 
to keep kids safe and the program is being offered to other provinces across 
Canada. 

• GetNetWise. Microsoft supports this public education organization and website 
(www .getnetwise.org) , which offer Internet users resources for making informed 
decisions about safer Internet use. 

• Get Safe Online. Microsoft is a founding sponsor, along with the UK govern- 
ment and other leading companies, of this campaign and website 
(www.getsafeonline.org) devoted to teaching consumers and businesses about 
Internet security and safety. 

• i-SAFE America’s i-LEARN. Microsoft is a sponsor of this free online curriculum 
for educators, parents, teens and law enforcement, which is available at 
www. ilearn. isafe. org. 
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• National Cyber Security Alliance (NCSA). Microsoft is part of this nonprofit 
public-private partnership that offers online safety and security information to 
the public on the www.staysafeonline.org website and through educational ef- 
forts such as National Cyber Security Awareness Month. 

• NCMEC Netsmartz. Microsoft has provided video production resources for the 
National Center for Missing and Exploited Children’s Netsmartz website 
(www.netsmartz.org), which helps educate parents, kids, teachers and law en- 
forcement about online security and safety issues. 

• NetSafe. NetSafe and Microsoft New Zealand developed this online safety site 
(www.hectorsworld.com), which offers Internet safety curricula for teachers as 
well as a range of fun activities for children that teach them about safer Inter- 
net use. 

• OnGuard Online. Microsoft helped develop the U.S. Federal Trade Commis- 
sion’s website at www.onguardonline.gov, which offers consumers tips, articles, 
videos and interactive activities related to online safety and security. 

• “Safety is no game. Is your family set?” Tour. Microsoft, Boys & Girls Clubs of 
America and Best Buy cosponsored a 20-city campaign to promote safer and 
age-appropriate gaming and to teach kids and parents about the Xbox 360 fam- 
ily safety features. 12 

• Staysafe.org. Microsoft sponsors and finances a website at www.staysafe.org 
that offers guidance and news about online security and safety issues. In 2006, 
Microsoft joined with the Federal Trade Commission, AARP, U.S. Chamber of 
Commerce, Best Buy and other partners to sponsor Staysafe. erg’s Get Net Safe 
Tour of 12 U.S. cities to raise awareness about Internet security and safety. 

• Wired Safety. Microsoft is helping to support Wired Safety’s first international 
conference on cyberbullying, at which representatives from government, edu- 
cation, the media, the technology industry and others will help raise awareness 
of this important issue and spur appropriate action. 

In addition to these partnerships, at our www.microsoft.com /protect /family 
website we offer our own broader information about consumer online safety in three 
key areas: 

• Family Safety — With young people online in record numbers we provide families 
with guidance to help promote personal safety and privacy. Just as parents 
teach their children to look both ways before they cross the street, Microsoft is 
working to help parents engage with their children to apply similar safety rules 
to protect kids online. 

• Protect Your PC — Helping users protect their PCs from threats like viruses and 
spyware is another key area of continued focus. 

• Protect Yourself — ID Theft is a significant concern for consumers. Microsoft is 
actively addressing ways to help people better protect themselves when online. 

Law Enforcement and Public Policy 

Microsoft is committed to helping make the Internet safer for all users, especially 
children and families, but we can’t do it alone. Partnerships with law enforcement 
agencies, governments, nonprofit organizations and other industry leaders are es- 
sential to combating cybercrime. Microsoft has also worked with governments to 
strengthen online safety and privacy laws and to develop mandatory Internet safety 
education programs in schools. These efforts address not only individual children’s 
use of the Web but also broader criminal issues like online child pornography. 

One highly successful effort is the Child Exploitation Tracking System (CETS), a 
system jointly developed by Microsoft and Canadian law enforcement to manage in- 
vestigations of child exploitation cases. CETS allows investigators to import, orga- 
nize, analyze and search large volumes of information while conducting investiga- 
tions and share information across law enforcement agencies. To date, CETS has 
been deployed in Canada, Brazil, Chile, Indonesia, Australia, Italy, Romania and 
the United Kingdom. 

In June 2006, Microsoft, AOL, Earthlink, United Online and Yahoo! announced 
a partnership with the National Center for Missing and Exploited Children 
(NCMEC) to fund a new Technology Coalition within NCMEC to develop and deploy 
technology solutions that disrupt the ability of online predators to exploit children 


12 Educational materials from the campaign, including a parent-child gaming pact that fami- 
lies can fill out, are available at http:l / www.xbox.com / en-US / support / family settings / 
isyourfamilysetldefault.htm. 
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or traffic in child pornography. The participating companies pledged US$1 million 
in combined initial funding as well as technical support and expertise. 

Microsoft has worked with Interpol and the International Centre for Missing & 
Exploited Children (ICMEC) to sponsor worldwide training sessions for law enforce- 
ment personnel on computer-facilitated crimes against children. As of February 
2008, more than 2,600 law enforcement officers from more than 100 countries have 
been trained in methods of identifying suspects, investigating offenses and dealing 
with victims of online child predators. 

In 2006, Microsoft joined ICMEC, NCMEC, leading financial institutions and 
Internet industry leaders to form the Financial Coalition Against Child Pornog- 
raphy , which provides a forum for members to collaborate on strategies to cutoff 
funding for child pornographers and eradicate child pornography. 

Microsoft works extensively with the U.S. Department of Justice’s Internet Crimes 
Against Children Task Force and is a member of the Virtual Global Taskforce, a 
public-private partnership that combats online child abuse worldwide. 

In 2008, Microsoft joined the Internet Safety Technical Task Force, a coalition of 
academics, industry, advocacy groups and others that examines issues related to 
Internet safety, online authentication and children’s age verification. 

Microsoft includes tools in its online services that can help detect and prevent 
child pornography and exploitation, and it is continually developing new tools both 
independently and in conjunction with its partners. MSN uses a filtering tool to re- 
view images uploaded to Windows Live Spaces and MSN Groups. Microsoft reports 
any images identified as apparent child pornography to NCMEC and closes the site. 
Microsoft also has a complaint center where users can report incidents of abuse on 
our sites. 

Microsoft has worked with state attorneys general in Alabama, Colorado, Georgia, 
Kansas, Massachusetts, New Hampshire, New Mexico, South Carolina and Utah to 
provide comprehensive training for law enforcement on computer-facilitated 
crimes. 13 

In April 2006, Microsoft joined ICMEC in announcing ICMEC’s model legislation 
on child pornography. This legislation seeks to modernize child pornography laws 
for the 184 member countries of Interpol; Microsoft has pledged to support efforts 
worldwide to develop and enforce these laws. 

Microsoft has joined industry partners to encourage countries to adopt and ratify 
the Council of Europe Convention on Cybercrime, which requires signatories to 
adopt and update laws and procedures to address crime in the online environment. 

Conclusion 

Microsoft has long been committed to helping protect children online. We take a 
comprehensive approach to online safety that includes the development of family 
safety technologies, guidance and education for families and children, and partner- 
ships with industry and law enforcement to combat online crime. 

Online child safety is directly in line with Microsoft’s overall commitment to pro- 
moting greater trust online and to offering products and services built with con- 
sumer safety in mind. Microsoft will continue to invest in programs, technologies 
and partnerships that advance the goals of safe computing for children and families. 

[The information contained in this document represents the current view of Micro- 
soft Corp. on the issues discussed as of the date of publication. Because Microsoft 
must respond to changing market conditions, it should not be interpreted to be a 
commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy 
of any information presented after the date of publication. 

Complying with all applicable copyright laws is the responsibility of the user. 
Without limiting the rights under copyright, no part of this document may be repro- 
duced, stored in or introduced into a retrieval system, or transmitted in any form 
or by any means (electronic, mechanical, photocopying, recording or otherwise), or 
for any purpose, without the express written permission of Microsoft. 

Microsoft may have patents, patent applications, trademarks, copyrights or other 
intellectual property rights covering subject matter in this document. Except as ex- 
pressly provided in any written license agreement from Microsoft, the furnishing of 
this document does not give you any license to these patents, trademarks, copy- 
rights or other intellectual property. 

Microsoft, Internet Explorer, Mediaroom, MSN, OneCare, Xbox 360, Xbox LIVE, 
Windows, Windows Live, Windows Vista and Zune are either registered trademarks 
or trademarks of Microsoft Corp. in the United States and/or other countries. The 


13 In the United States, the attorney general is the state government’s chief legal advisor and 
law enforcement officer. 
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names of actual companies and products mentioned herein may be the trademarks 
of their respective owners.] 

Senator Pryor. Thank you. 

Dr. Montgomery? 

STATEMENT OF KATHRYN C. MONTGOMERY, Ph.D., 
PROFESSOR, SCHOOL OF COMMUNICATION, 
AMERICAN UNIVERSITY 

Dr. Montgomery. Chairman Rockefeller, Chairman Pryor, Rank- 
ing Member Wicker, and members of the Committee — the Sub- 
committee, thanks so much for inviting me to testify about COPPA. 
It’s a law I care very deeply about. 

During the 1990s, while President of the nonprofit Center for 
Media Education, I played a leadership role in passage of COPPA, 
working with Members of Congress on both sides of the aisle, as 
well as a coalition of prominent education, health, and consumer 
groups. 

And I think we need to remember that, in the early days of the 
World Wide Web, which was really a kind of Wild West period, the 
business model of one-to-one marketing, combined with the increas- 
ing value of children as a target market for advertisers, created, 
really, a “perfect storm” for marketers who wanted to use the 
Internet to take advantage of young people. We and others docu- 
mented many of those practices. And if we need to remind our- 
selves of where we were, we can remember sites like the Young In- 
vestors site that asked for reams of personal financial information 
from children, or one of my favorites, which was the Batman site, 
which asked children to be good members of Gotham and fill out 
the census. That’s what we were looking at, at the time. That’s 
where the Internet was headed. 

My colleagues and I consulted with a broad spectrum of stake- 
holders, including industry groups, to craft a set of regulations that 
would successfully balance our collective interest in nurturing the 
growth of e-commerce while protecting the privacy of our children. 

And I think COPPA has served us all very well. It has created 
a level playing field by creating a law that applied to every online 
commercial player, from the largest children’s media companies to 
the smallest startups, and it sends a signal to the industry, “If 
you’re going to do business with our Nation’s children, you will 
have to follow some rules.” And because it was passed during the 
early stages of e-commerce, it has created rules of the road that 
have helped to guide the development of the digital marketplace 
and, really, curtail many of the egregious practices that were com- 
ing into place. 

And I also think the Safe Harbor mechanism is very important, 
because it permits self-regulation, but within the context of clear 
government rules and enforcement authority by the FTC. 

But, as others have pointed out, recent developments in online 
marketing really warrant renewed attention by the FTC and the 
Congress. Today’s children are growing up in an immersive and 
ubiquitous digital media environment, 24/7, and many of the prac- 
tices we identified in the 1990s have been eclipsed by an entirely 
new generation of tracking and targeting technologies. Briefly, I’ll 
highlight two. 
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One is behavioral targeting, which is an invisible process and a 
covert process that tracks individual users, through cookies and 
other data files, to collect information about them, and to design 
personalized advertising to target them, based on their psycho- 
logical profiles and their behavioral profiles. And this also raises 
the question of what constitutes “personally identifiable informa- 
tion.” It’s not just a matter of your giving your name. The market- 
ers are able to know who you are, and get to you and target you. 

And the second is mobile marketing, which people have men- 
tioned. And one of the important things is that it combines behav- 
ioral targeting with location targeting. And the research that I’ve 
done on children’s food marketing and the obesity crisis has found 
fast-food companies creating discount coupons that will be sent to 
people’s and children’s cell phones when they get near a fast -food 
restaurant. 

So, what we need to do is to ensure the FTC — and I’m working 
with the agency to update the law, update the rules, as it was in- 
tended to do, as it was designed to do. 

Finally, I do want to say that, while COPPA has established im- 
portant safeguards for the youngest consumers in the digital mar- 
ketplace, adolescents have no such protections. We know they’re 
avid users of social networks, like Facebook and MySpace and oth- 
ers. In many ways, they’re living their lives online, and they’re in- 
creasingly relying on these social networks and on search for per- 
sonal information and for handling sensitive personal issues that 
they’re coping with in their lives. 

So, I would argue, we — I’m not arguing for a parental verification 
system, like COPPA, but I do think we need a set of fair informa- 
tion and marketing practices that are tailored to the unique needs 
and vulnerabilities of adolescents. 

So, I hope the Committee will send a message to the FTC that 
COPPA remains important, but needs to be updated, and also, that 
the FTC should develop specific recommendations for protecting 
the privacy of adolescents as part of its broad new initiative on on- 
line privacy. 

Thank you. 

[The prepared statement of Dr. Montgomery follows:] 

Prepared Statement of Kathryn C. Montgomery, Ph.D., Professor, 
School of Communication, American University 

Chairman Pryor, Senator Wicker, and members of the Subcommittee. My name 
is Kathryn Montgomery, and I am a Professor in the School of Communication at 
American University. I appreciate the opportunity to testify before you today about 
the Children’s Online Privacy Protection Act (COPPA). During the 1990s, while 
president of the nonprofit Center for Media Education (CME), I played a leadership 
role in the passage of COPPA, working with a coalition of education, health, and 
consumer groups that included the National PTA, the Consumer Federation of 
America, the National Education Association, and the American Academy of Pediat- 
rics. As you know, Congress passed the law in 1998 through the strong bi-partisan 
leadership of Sen. John McCain (R-Ariz.), Rep. Ed Markey (D-Mass), and then-Sen. 
Richard Bryan of Nevada. I worked closely with these Congressional leaders and 
with other members, as well as with the Federal Trade Commission and the White 
House, on the legislation. I also collaborated with a broad spectrum of industry 
stakeholders — including advertising trade groups, online content providers, and chil- 
dren’s media companies — to craft a statute and a set of regulations that would suc- 
cessfully balance our collective interests in nurturing the growth of e-commerce, 
while protecting the privacy of our children. 
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For the past decade, COPPA has served as an effective safeguard for young con- 
sumers under the age of 13 in the online marketing environment. Though the law 
took effect in the early formative period of Internet marketing, it was purposely de- 
signed to adapt to changes in both technology and business practices, with periodic 
reviews by the FTC to ensure its continued effectiveness. With the current expan- 
sion of digital media platforms and the growing sophistication of online data collec- 
tion and profiling, however, it is now critically important that the intent of COPPA 
be fully implemented to protect young people from new commercial practices in to- 
day’s digital media environment. 

As I document in my book, Generation Digital: Politics, Commerce and Childhood 
in the Age of the Internet, the emergence of the World Wide Web ushered in a host 
of online marketing and data collection practices that raised fundamental privacy 
concerns for children. The business model of one-to-one marketing, combined with 
the increasing value of children as a target market for advertisers, created a perfect 
storm for marketers who wanted to use the Internet to take advantage of young peo- 
ple. Numerous commercial websites offered prizes and other incentives to encourage 
children to supply personal information about themselves. For example, one site tar- 
geted at “young investors,” urged children to provide an astonishing amount of fi- 
nancial information, including any gifts they might have received in the form of 
stocks, cash, savings bonds, mutual funds or certificates of deposit. Another site, set 
up to promote the movie Batman, encouraged children to “be good citizens of 
Gotham” and fill out the “census.” 1 Some of these practices were so disturbing that 
the Center for Media Education enlisted the help of Georgetown University Law 
Center’s Institute for Public Representation to file a complaint with the FTC in 
1996. The commission found our complaint persuasive and, with the urging of our 
coalition and others, began examining the children’s online data collection commer- 
cial market. 2 The FTC’s internal research played a key role in documenting the 
rampant spread of data collection and the failure of self-regulatory promises by in- 
dustry. The commission’s report, released just months prior to passage of COPPA, 
provided crucial evidence of the need for this important law. 3 

Congress made a wise decision in 1998 to enact COPPA. I believe the law has 
been a clear legislative success. It was a balanced and sensible solution to a chal- 
lenging problem. It established a level playing field by creating a law that applied 
to every commercial player — from the largest children’s media companies to the 
smallest startups. And it sent a strong signal to the growing online marketing in- 
dustry: If you are going to do business with our Nation’s children, you will have to 
follow some basic rules. Because decades of research documented younger children’s 
particular vulnerabilities to advertising and marketing, the law was narrowly tai- 
lored to apply only to commercial websites that were targeted at children under the 
age of 13, or where there was actual knowledge by the website operator that the 
user was under that age. In keeping with fair information principles, a key intent 
of the law was to minimize the collection of personally identifiable data from chil- 
dren, and to eliminate the practice of offering prizes and other incentives to encour- 
age such data collection. 4 

No law is perfect, as everyone in this body is well aware. In the case of COPPA, 
children who are under 13 can lie about their age when visiting sites that are not 
intended for them. Parents are not always willing or able to be involved in the day- 
to-day online navigations of their children. But because the legislation was passed 
during the early stages of Internet e-commerce, COPPA established a clear set of 
“rules of the road” to help guide the development of the children’s digital market- 
place. As a result, some of the most egregious data collection practices that were 
becoming state-of-the-art in the online marketing environment were curtailed. A 


1 Kathryn Montgomery, Generation Digital: Politics, Commerce, and Childhood in the Age of 
the Internet (Cambridge, MA: MIT Press, 2007); Kathryn Montgomery and Shelly Pasnik, Web 
of Deception: Threats to Children from Online Marketing (Washington, D.C.: Center for Media 
Education, 1996). 
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study in the Journal of Consumer Affairs found that more than ninety-five percent 
of the top 100 children’s websites in the United States post privacy policies com- 
plying with COPPA’s requirements for information collection and use. 5 And by es- 
tablishing a safe -harbor mechanism, the law created a system whereby self-regu- 
latory guidelines — developed and implemented by a number of entities — operate 
within a framework of clear government rules and enforcement authority by the 
FTC. We are pleased that the commission has taken the initiative to examine and 
respond to specific cases, cracking down on those practices that violated the stat- 
ute. 6 

Recent developments in the online marketing arena, however, pose new chal- 
lenges that warrant the attention of the FTC and Congress. The Web has matured, 
thanks especially to broadband and mobile technologies. As a result, not only has 
the digital marketplace grown dramatically, it has become an even stronger pres- 
ence in the lives of young people. Today’s children are growing up in a ubiquitous 
digital media environment, where mobile devices, instant messaging, social net- 
works, virtual reality, avatars, interactive games, and online video have become in- 
grained in their personal and social experience. Members of this generation of young 
people are, in many ways, living their lives online. As Advertising Age reported, 
“more than 16 million children aged 2 to 11 are online, making for a growth rate 
of 18 percent in the period 2004 to 2009 — the biggest increase among any age group, 
according to Nielsen.” The same report explains that according to a Nielsen Online 
survey conducted in July 2009, “Time spent online for children ages 2 to 11 in- 
creased from about 7 hours to more than 1 1 hours per week, or a jump of 63 percent 
over 5 years.” 7 

The online marketing practices we originally identified in the 1990s have been 
eclipsed by a new generation of tracking and targeting techniques. For example, mo- 
bile marketing — combining text messaging, mobile video, and other new applica- 
tions — is one of the fastest growing digital commerce platforms throughout the 
world, and a particularly effective way to reach and engage children. 8 As a recent 
Kaiser Family Foundation study noted, “Over the past 5 years, there has been a 
huge increase in [cell phone] ownership among 8- to 18-year-olds: from 39 percent 
to 66 percent. . . . During this period, cell phones . . . have become true multi- 
media devices: in fact, young people now spend more time listening to music, play- 
ing games, and watching TV on their cell phones (a total of :49 daily) than they 
spend talking on them (:33).” 9 According to the latest industry data, roughly half 
of all children use a mobile phone by age 10, and by age 12, fully three-fourths of 
all children have their own mobile phone. 10 As one media executive commented, the 
mobile phone is “the ultimate ad vehicle . . . the first one ever in the history of 
the planet that people go to bed with.” 11 Mobile advertising will increasingly rely 
on interactive video and become firmly embedded in “mobile social networks.” Ad- 
vertising on mobile devices will be especially powerful, since it will be able to target 
users by combining both behavioral and location data. 12 Ads on mobile phones will 
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be able to reach young consumers when they are near a particular business and 
offer electronic pitches and discount coupons. 13 

Behavioral targeting uses a range of online methods — including cookies and invis- 
ible data files — to learn about the unique interests and online behaviors through the 
tracking and profiling of individual users. Through a variety of new techniques, 
marketers use this data to create personalized marketing and sales appeals based 
on a customer’s unique preferences, behaviors, and psychological profile. 14 Recent 
advances in behavioral targeting are enabling marketers to more accurately predict 
and influence user behavior. For example, “predictive behavioral targeting” com- 
bines data from a number of different sources and makes inferences about how 
users are likely to behave in their response to marketing messages. Increasingly, 
behavioral profiles incorporate information from outside databases. 15 Social media 
platforms are also embracing behavioral targeting, helping to drive “robust adver- 
tising response and conversion.” 16 

Last year, a broad coalition of consumer, children, and privacy groups urged the 
FTC to ensure that new technologies involving mobile phones and data collection 
incorporate COPPA relevant safeguards. These groups also want the FTC to deter- 
mine how behavioral marketing impacts children covered by COPPA, by analyzing, 
for example, the stealth data collection process delivered by online games, virtual 
worlds, and age-relevant social sites. 17 In its current review, the commission must 
ensure that its regulations implementing COPPA include the full range of Internet 
-enabled or connected services, including the increasingly ever-present cell phones 
children use, along with Web-connected gaming devices and online, interactive 
video. 18 Congress intended COPPA’s basic framework to be flexible, anticipating 
that the FTC would have to ensure that the law’s implementation would cover new 
ways of collecting personal information from children. 19 That’s why I strongly sup- 
port the FTC asking, in its recent Federal Register notice, whether COPPA’s defini- 
tion of personal information should be revised to include the latest methods of iden- 
tifying and targeting online consumers, covering the so-called “cookies” that are 
used for interactive marketing data collection, as well as “mobile geo-location infor- 
mation.” 20 As the February 2009 FTC staff report on online privacy acknowledged, 
“in the context of online behavioral advertising, the traditional notion of what con- 
stitutes PII [personally-identifiable information] versus non-PII is becoming less and 
less meaningful and should not, by itself, determine the protections provided for 
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consumer data.” 21 I also support ensuring that parents have reasonable and effec- 
tive methods to “review or delete personal information” in their children’s online 
file. 

Without question, digital media play a critically important role in the positive de- 
velopment of children and youth, helping them become better educated and pro- 
viding a foundation for their engagement as citizens. 22 But, there are also risks and 
dangers online, as many of us are aware. When COPPA was created, one of our con- 
cerns was to ensure that the ability to identify, track, and target a child — whether 
online or off — was mediated through Congressional safeguards mandating parent in- 
volvement. And while young people — and adults — today are being continually urged 
to make more of their personal information available in real-time, including their 
location, research indicates the few people understand how that information is col- 
lected and used. Even young adults, according to a new study released just last 
week, want to ensure their privacy is secured online. The study, conducted by schol- 
ars from UC Berkeley and the Annenberg School for Communication, University of 
Pennsylvania, found that “large percentages of young adults (those 18-24 years) are 
in harmony with older Americans regarding concerns about online privacy, norms, 
and policy. . . . [Y]oung-adult Americans have an aspiration for increased privacy 
even while they participate in an online reality that is optimized to increase their 
revelation of personal data.” 23 As those responsible for the welfare of our children, 
adults must provide reasonable safeguards for protecting their privacy, especially to 
help them maneuver through an increasingly complex commercial online data collec- 
tion marketplace. 24 

Some people suggest that children are now so fully steeped in online technologies 
that they have become savvy about Internet marketing, and thus need no protec- 
tions. 25 But while children and youth have embraced new technologies, they cannot 
be expected to understand the subtle, often covert ways that online marketers are 
collecting, compiling, and analyzing user data. Nor should youth be held accountable 
for the public health implications of the new marketing environment. Over the last 
several years, I have closely examined these developments, helping direct a project 
examining how digital marketing targets both children and adolescents for food and 
beverage products linked to the country’s youth obesity crisis. 26 

Finally, while passage of COPPA established an important framework for safe- 
guarding our youngest consumers in the digital marketplace, adolescents have no 
such protections. Neither the online industry nor the Federal Trade Commission has 
adequately addressed the special privacy issues raised for adolescents. Because of 
their avid use of new media, adolescents are primary targets for digital marketing. 27 
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Today’s teens are being socialized into this new commercial digital culture, which 
resonates so strongly with many of their fundamental developmental tasks, such as 
identity exploration, social interaction, and autonomy. 28 Many teens go online to 
seek help for their personal problems, to explore their own sexual identities, to find 
support groups for handling emotional crises in their lives, and sometimes to talk 
about things they do not feel comfortable or safe discussing with their own parents. 
Yet, this increased reliance on the Internet subjects them to wholesale data collec- 
tion and profiling. The unprecedented ability of digital technologies to track and pro- 
file individuals across the media landscape, and to engage in “micro” or “nano” tar- 
geting, puts these young people at special risk of compromising their privacy. Teens 
may be internalizing and normalizing these invasive practices that have been so in- 
tegrally woven into their everyday actions and experiences. 

As child advocacy and health groups explained in an April 2008 filing with the 
FTC, “although adolescents are more sophisticated consumers than young children 
are, they face their own age-related vulnerabilities regarding privacy.” The pre- 
vailing formula embraced by industry and endorsed by regulators is rooted in the 
concept of “notice and choice.” It is based on the expectation that consumers will 
read the privacy policies that online companies post on their websites, and if they 
don not like the terms, they will “opt out.” But most privacy policies offer no real 
choice; instead the policies are presented as a “take-it-or-leave-it” proposition. Sur- 
veys have shown that most adults don’t read, nor can they readily understand, the 
often confusing, technical legalese that characterizes these policies. 29 For under- 
aged youth, these challenges are further complicated. As the children’s coalition fil- 
ing points out, “. . . adolescents, who have less education and are less likely to 
make the effort to read privacy policies,” are “more willing to forgo learning about 
or protecting against behavioral advertising practices. . . in order to move quickly 
and freely access websites and socially interact.” 30 Social networks have created pri- 
vacy settings that create a false sense of security for teens. While young people may 
believe they are protecting their privacy, they remain totally unaware of the nature 
and extent of data collection, online profiling, and behavioral advertising that are 
becoming routine in these online communities. 

Recent research within the fields of neuroscience, psychology, and marketing has 
identified key biological and psychosocial attributes of the adolescent experience 
that may make members of this age group particularly susceptible to interactive 
marketing and data collection techniques. 31 A number of scholars have challenged 
the notion that cognitive defenses enable adolescents to resist advertising (particu- 
larly in new media) more effectively than younger children. 32 Rather than commu- 
nicating rational or factual appeals, many digital marketing techniques are forms 
of “implicit persuasion” that promotes “subtle affective associations,” often circum- 
venting a consumer’s explicit persuasion knowledge. 33 

In addition to its review of COPPA, the FTC should develop specific recommenda- 
tions for protecting the privacy of adolescents as part of its broad new initiative on 
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online privacy. 34 Child advocacy and health groups, for example, have called for an 
expanded definition of “sensitive data” to include the online activities of all persons 
under the age of eighteen, as well as a prohibition against “the collection of sensitive 
information for behavioral advertising purposes.” 35 

I hope this committee will send a message to the FTC, as you review the record, 
that COPPA remains a valuable safeguard for children online, but the rules for im- 
plementing it need updating to account for the latest developments in digital mar- 
keting. I also urge the Committee to encourage the FTC to protect the privacy of 
adolescent consumers. 

Senator Pryor. Thank you. 

Mr. Rotenberg. 

STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR, 
EPIC AND ADJUNCT PROFESSOR, 

GEORGETOWN UNIVERSITY LAW CENTER 

Mr. Rotenberg. Thank you very much, Mr. Chairman, members 
of the Committee. I appreciate the opportunity to be here today. 

I’m the Director of EPIC. We’re a nonprofit research organiza- 
tion. I also teach privacy law at Georgetown. 

I actually wanted to begin by thanking Professor Montgomery for 
the leadership role she played in helping to ensure passage of the 
Act. We wrote to the FTC, back in 1995, and asked the Commission 
to look at the business practices involving the collection and use of 
personal information on children. And following that letter and the 
hearings and the subsequent work of the consumer coalition, Con- 
gress did, in fact, pass important legislation. And we think that 
legislation set up the simple principle that, in this new online envi- 
ronment, it was important to protect young people from the exploi- 
tation and manipulation of their personal information. 

And I think it’s obvious that there have been dramatic changes 
since the time that COPPA has been enacted. And the most obvi- 
ous change is the emergence of the social network services. Our 
kids live online, exchanging intimate information with their 
friends; and that information is then collected and used for mar- 
keting purposes. And while their disclosures to their friends ap- 
pear, to them, to be very transparent and to give them a great deal 
of control over what they choose to post or not post, what’s going 
on behind the scenes, in terms of the transfer of their data by com- 
panies, such as Facebook, to their advertising partners, to their ap- 
plication development partners, and now to the third-party 
websites that they propose to transfer information about, is much 
more opaque. 

Now, Facebook said earlier — and I think this is true — that, for 
the most part, they’ve tried to discourage the use of the service by 
children under the age of 13 so that they remain compliant with 
COPPA. But, what they haven’t addressed, and I think the critical 
question now before the Committee, is, How do we deal with the 
collection and use of this personal information on teenagers, chil- 
dren between the ages of 13, whose data is being collected in this 
online environment, and then disclosed to marketers and others for 
purposes completely unrelated to the reasons that they made it 
available? 
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The problem is more serious, still, because, in this setting, the 
user has to rely on the privacy policies and the privacy settings 
that they are presented with. That’s essentially the only way, in a 
self-regulatory environment, you are going to get privacy protec- 
tion. And what we are seeing, increasingly, is that companies, hav- 
ing collected the data on teenagers, will change the privacy policies, 
they will change the privacy settings, for the purpose of making 
this data more easily accessible to business partners for marketing 
purposes. This is a problem that COPPA never anticipated. And I 
think it is the single-biggest problem facing children in the online 
world today. The self-regulatory approach that relies on privacy 
settings and privacy policies is not working. 

And it’s also not working, in part, I regret to say, because I don’t 
think the Federal Trade Commission has been as aggressive as it 
needs to be to go after what are essentially unfair and deceptive 
trade practices. They do a very good job on the education side, no 
doubt about it; and they have provided very good materials, to fam- 
ilies and teachers and educators and others, about what people 
need to do to protect the safety of their children online. But, they 
have not done enough to enforce these unfair and deceptive trade 
practices. And I think they need to do more. 

I want to tell you, briefly, one extraordinary story, a complaint 
that we filed with the Federal Trade Commission last year that 
was offering a product, ostensibly, for parental control. It was sup- 
posed to protect kids online from, you know, risks and dangers that 
parents might be worried about. The same company was gathering 
the data, through this product that they made available, for mar- 
keting purposes. And this is how they described their own product, 
“Every single minute, Pulse is aggregating the Web’s social media 
outlets, such as chat and chat rooms, blogs, forums, instant mes- 
saging, and websites, to extract meaningful user-generated content 
from your target audience: the teens.” They’re talking to a mar- 
keting firm about how they’re able to surreptitiously gather infor- 
mation on kids online. 

We went to the FTC, and we said to the FTC, “You need to shut 
down this company.” The FTC acknowledged the receipt of our 
complaint, but never acted on it. 

But, the story doesn’t end there. When the Department of De- 
fense learned about how this product operated, and they were, at 
the time, planning to make it available online to military families 
through their online store, they said, “This poses a risk, a privacy 
and security risk, to military families, and we will not make it 
available.” 

In other words, the Department of Defense, acting on informa- 
tion that anyone who had taken a close look at the product would 
have quickly recognized was a serious problem, made an appro- 
priate decision. 

The FTC, which has the authority and the expertise to police 
COPPA, never acted. 

I think, in both of these areas, the need to update the law so that 
there are protections for teenagers, those between 13 and 18, from 
the misuse of the commercial information, and also for the FTC to 
get much more aggressive on enforcement. Education is not enough 
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in this area. They have to go after these companies that are not 
acting appropriately when they collect and use personal data. 

Thank you very much. 

[The prepared statement of Mr. Rotenberg follows:] 

Prepared Statement of Marc Rotenberg, Executive Director, EPIC and 
Adjunct Professor, Georgetown University Law Center 

Introduction 

Mr. Chairman and members of the Committee, thank you for the opportunity to 
testify today on “An Examination of Children’s Privacy: New Technologies and the 
Children’s Online Privacy Protection Act (COPPA)” My name is Marc Rotenberg and 
I am the Executive Director of the Electronic Privacy Information Center (EPIC) 
and Adjunct Professor at Georgetown University Law Center. 

EPIC is a non-partisan research organization, focused on emerging privacy and 
civil liberties issues. We have a particular interest in children’s online privacy. In 
1995, EPIC wrote to then-FTC Commissioner Christine Varney, exposing industry 
practices that “ma[de] available to the public the names, addresses, ages and tele- 
phone numbers of young children.” 1 We urged the FTC to investigate these business 
practices and to develop appropriate safeguards. 

In 1996, I testified before the House Judiciary Committee in support of the bill 
that eventually became COPPA. 2 I warned: “The collection of data about children 
is growing at a phenomenal rate. Government agencies, private organizations, uni- 
versities, associations, businesses, and club all gather information on kids of all 
ages. Records on our children are collected literally at the time of birth, segmented, 
compiled, and in some cases resold to anyone who wishes to buy them.” 

EPIC worked with the Center for Media Education, which had published a 
groundbreaking study in 1996 on children’s privacy, to develop COPPA and help en- 
sure enactment. As the CME study found, young children cannot understand the po- 
tential effects of revealing their personal information; neither can they distinguish 
between substantive material on websites and the advertisements surrounding it. 
Targeting of children by marketing techniques resulted in the release of huge 
amounts of private information into the market and triggered the need for COPPA. 3 

For the past 15 years, EPIC has pursued many of the critical online privacy issues 
concerning children. We have testified before lawmakers in support of strong pri- 
vacy safeguards for children. EPIC has also filed complaints with the Federal Trade 
Commission detailing unfair and deceptive trade practices that put children’s pri- 
vacy at risk. 

We are also interested in emerging new technologies and practices that increase 
the amount of data collected about children. For example, EPIC filed several com- 
plaints and a “friend of the court” brief concerning social networking sites’ privacy 
practices. 4 These sites encourage users to make social connections online, but also 
build detailed profiles about users, and disclose personal information to third par- 
ties. In addition, EPIC has filed regulatory complaints and court documents con- 
cerning behavioral marketing practices — practices that expose Internet users’ per- 
sonal information to marketers, advertisers, and others without users’ knowledge. 5 
These emerging practices affect many consumers, but children are particularly vul- 
nerable. 

We appreciate your interest in children’s privacy and new technology, and we are 
grateful for the opportunity to appear before the Committee today. 


iEPIC Letter to Christine Varney on Direct Marketing Use of Children’s Data, EPIC, Decem- 
ber 14, 1995 available at http:/ / epic.org / privacy / internet / ftc / ftc letter.html. 

2 Testimony and Statement for the Record of Marc Rotenberg, director Electronic Privacy In- 

formation Center on the Children’s Privacy Protection and Parental Empowerment Act, H.R. 
3508 Before the House of Representatives, Committee on the Judiciary, Subcommittee on Crime, 
September 12, 1996 available at http: // www.epic.org / privacy / kids / EPIC Testimony.html. 

3 Center for Media Education, Web of Deception: Threats to Children from Online Marketing, 
1996 available at http://www.cme.org/children/marketing/deceptionpdf; see also supra notes 
1 - 2 . 

4 EPIC, In re Facebook, http://epic.org/privacy/inrefacebook/; EPIC, In re Google Buzz; 
http:llepic.org/privacylftclgooglebuzz/default.html; EPIC, Harris v. Blockbuster, http :// 
epic.org/amicus/blockbuster/default.html. 

5 EPIC, Privacy ? Proposed Google /Doubleclick Merger, http:/ / epic.org / privacy /ftc / google j ; 
EPIC, Google Books Litigation, http:/ / epic.org /privacy / googlebooks / litigation.html. 
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IThe Purpose of COPPA and Structure of COPPA is Essentially Sound 

The Children’s Online Privacy Protection Act, as set out in the FTC Rule, estab- 
lishes a basic framework for privacy protection. COPPA requires any website that 
collects personal information from children to: (1) “provide notice on the website of 
what information is collected from children by the operator, how the operator uses 
such information, and the operator’s disclosure practices for such information;” 6 (2) 
“obtain verifiable parental consent for the collection, use, or disclosure of personal 
information from children;” 7 (3) provide parents witb access to the information col- 
lected from their children; 8 and (4) “establish and maintain reasonable procedures 
to protect the confidentiality, security, and integrity of personal information col- 
lected from children.” 9 

The FTC Rule that was promulgated included several innovative provisions, in- 
cluding one that prohibits operators from conditioning a child’s participation in an 
online activity on the child’s providing more information than is reasonably nec- 
essary to participate in that activity. 10 That provision wisely anticipated that 
websites would try to extract data from children unless it was made clear that only 
the information necessary to provide the service should be obtained. 

Some websites, 11 including social network websites, 12 comply with COPPA by im- 
plementing privacy safeguards for their young users. Many other websites, 13 includ- 
ing social network sites, 14 allege that their sites do not collect personal information 
from children, and are therefore exempt from COPPA requirements. Disputes over 
COPPA typically focus on the age verification procedures and the scope of applica- 
tion. 

Overall, COPPA has helped to establish a general understanding that the collec- 
tion and use of information on young children should be treated with care and 
avoided if possible. This is a sensible approach that recognizes both the unique 
vulnerabilities of young children as well as the limitations of a self-regulatory ap- 
proach, which would place the burden on minors to interpret privacy policies and 
make informed decisions about the disclosure and use of personal information. 

We supported COPPA at the time of enactment and continue to believe it provides 
a sound basis for privacy protection. 

Social Networks Have Transformed Data Collection Practices 

It is clear that the single biggest change impacting the privacy of children since 
the adoption of COPPA has been the emergence of social network services, such as 
Facebook, MySpace, and Twitter. These web-based platforms provide new opportuni- 
ties for kids to interact online and also for companies to gather up information. 

Leaving aside for the moment whether sites are currently in compliance with 
COPPA as they tend to discourage participation by those thirteen and under, I 
would like to focus on the broader implications that this technological change has 
had on children’s privacy. In the simplest terms, COPPA did not anticipate the 
immersive online experience that a social network service would provide or the ex- 
tensive data collection of both the trivial and the intimate information that children 
would share with these friends. This is not to say that the COPPA rules do not 
apply to all forms of data collection, rather the point is that the data collection and 
use is much more extensive than was anticipated. 

We also see the increasingly opaque way that companies transfer user information 
to third parties. On the one hand, there is a great deal of transparency when users 
are able to see what they post and to make decisions about who should have access. 


6 15 U.S.C. § 6502(b)(l)(A)(i) (2009). 

7 15 U.S.C. § 6502(b)(l)(A)(ii) (2009). 

8 15 U.S.C. § 6502(b)(1)(B) (2009). 

9 15 U.S.C. § 6502(b)(1)(D) (2009). 

10 15 U.S.C. § 6502(b)(1)(C) (2009). 

rl E.g. The Walt Disney Co., Kids’ Privacy Policy, http : / / corporate.disney.go.com / corporate / 
kids.html (“Building on our general Privacy Policy, we recognize the need to provide additional 
privacy protections when children visit the sites on which this Kids’ Privacy Policy is posted.”). 

12 E.g. Yoursphere, Yoursphere For Parents, http:/ / internet-safety.yoursphere.com / news / twi-t- 
ter-facebook-coppa-the-yoursphere-difference (“Yoursphere is a membership-based, online social 
community exclusively for youth through the age of 18. Here’s how Yoursphere meets, and ex- 
ceeds COPPA guidelines. . . .”). 

13 E.g. N.Y. Times, The New York Times Privacy Policy Highlights, (“The New York Times 
does not knowingly collect or store any personal information, even in aggregate, about children 
under the age of 13.”); U.S. Bank, Privacy Policy , https:! / loansandlines.usbank.com/loanslines I 
privacyPopup.do (“We do not intentionally market to or solicit personal information from chil- 
dren under the age of 13.”). 

14 E.g. Facebook, Help Center, http:/ lwww.facebook.com /help! ?safety=parents (“Facebook re- 
quires its users to be at least 13 years old before they can create an account. Providing false 
information to create an account is a violation of our Statement of Rights and Responsibilities.”). 
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On the other, the transfer of user data to application developers and now to 
websites is not so easy for users to observe and control. 

More specifically, there is growing concern that companies are manipulating their 
privacy policies and privacy settings of users to confuse and frustrate users so that 
more personal information will be revealed. EPIC raised this concern in a petition 
filed with the Federal Trade Commission last December concerning the business 
practices of Facebook. 15 More recently, Senators Schumer, Bennet, Begich, and 
Franken have expressed to Facebook their concern about the most recent changes 
in Facebook’s business model. 16 Senator Schumer specifically asked the FTC to de- 
velop guidelines for these services. 17 Similar concerns are likely to arise with Twit- 
ter as the company begins to incorporate advertising and to track the activities of 
its users. 

There is a good argument that these data collection practices should be regulated 
for all users simply because all users have an interest in how their personal infor- 
mation is used by these firms. But the argument is particularly strong for teen- 
agers, those between the ages of 13 and 18, who have no protection under COPPA 
and who cannot easily follow all of the changes taking place in this self- regulatory 
environment. In fact, in our recent complaint to the FTC concerning Facebook, we 
were struck by how many Internet commentators, bloggers, and security experts 
found it difficult to make sense of the recent changes in the Facebook privacy set- 
tings. 18 

Therefore, updates to COPPA should focus specifically on the collection and use 
of data in the social network world. Teenagers should be given much greater control 
over the collection of data about them. 

The FTC Has Failed to Enforce Children’s Privacy Rights Despite Clear-Cut 
Violations 

One of the growing concerns with COPPA is the failure of the Federal Trade Com- 
mission to vigorously enforce its provisions. Several years ago, there were notable 
enforcement actions by the FTC. For example, in September 2006, the FTC brought 
COPPA enforcement actions against several companies. The FTC fined the website 
Xanga $1 million for failing to obtain parental consent for children under 13 even 
though the site clearly targeted this population. 19 And the FTC fined UMG Record- 
ings $400,00 for similar violations. 20 

But it is difficult to find news of any recent enforcement action. The FTC claims 
on its website: 

The FTC has obtained numerous Federal district court settlements against 
website operators who are alleged to have violated the COPPA Rule. Press re- 
leases, and the complaints and orders may be found at www.ftc.gov / privacy / 
privacyinitiatives / childrens enf.html. 

But if you go to this link, you will find just one enforcement action over the last 
several years, which was taken against the Iconix Brand group and produced a fine 
of $250, 000. 21 

EPIC’s experience with the recent Echometrix complaint is particularly telling. In 
September 29, 2009, EPIC filed a detailed complaint with the Federal Trade Com- 
mission alleging that Echometrix, a software company, was selling “parental con- 
trol” software that was in fact monitoring children’s online activity for marketing 
purposes. 22 As the company itself stated about its datamining service Pulse: 


15 EPIC, In re Facebook, http:/ Jwww.epic.org/privacylinrefacebook/EPIC-FacebookCom 
plaint.pdf. 

16 Letter from Senator Charles Schumer, Senator Michael Bennet, Senator Mark Begich, and 
Senator A1 Franken to Facebook CEO Mark Zuckerberg, Apr. 27, 2010 available at http:/ / 
voices.washingtonpost.com / posttech / Schumer-Franken-Bennet-Begich%20Letter%20to%20Face 
book%204.27.10.pdf. 

17 Id. 

18 Supra note 15 at 16—23. 

19 FTC, Xanga.com to Pay $1 Million for Violating Children’s Online Privacy Protection Rule, 
Sept. 7, 2006, http: // www.ftc.gov / opa / 2006 / 09 / xanga.shtm. 

2°ftC, UMG Recordings, Inc. to Pay $400,000, Bonzi Software, Inc. To Pay $75,000 to Settle 
COPPA Civil Penalty Charges, Sept. 13, 2006, http: / / www.ftc.gov / opa 12004 / 02 /bonz 
iumg.shtm. 

21 FTC, Iconix Brand Group Settles Charges Its Apparel Web Sites Violated Children’s Online 
Privacy Protection Act, Oct. 20, 2009, http :/ / www.ftc.gov / opa / 2009 / 10 / iconix. shtm. 

22 EPIC, In re Echometrix, http://epic.org/privacy/ftclEchometrix%20FTC%20Complaint%20 
final.pdf, see EPIC, EPIC-Echometrix, http: // epic.org / privacy / echometrix / . 
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Every single minute, Pulse is aggregating the Web’s social media outlets such 
as chat and chat rooms, blogs, forums, instant messaging, and websites to ex- 
tract meaningful user generated content from your target audience, the teens. 23 

The EPIC complaint asked the FTC to stop these practices, seek compensation for 
victims, and ensure that Echometrix’s collection and disclosure practices comply 
with COPPA. 

The Federal Trade Commission acknowledged receipt of the complaint, but never 
took an enforcement action against the company. As far as we know, they never 
even opened an investigation. 

You might conclude that perhaps our complaint was mistaken or that maybe the 
company had changed its practices, but there is more to the Echometrix story. Not 
long after we filed the complaint with the FTC, we learned that the Department 
of Defense shared our concerns about this product, particularly as it would place 
at risk children in military families. 

In an e-mail that we obtained through a Freedom of Information Act request, we 
learned that the Manager of the AAFES’ Exchange Online Mall, which provides 
products and services for military families around the world, wrote to Echometrix: 

I was forwarded the attached complaint submitted to the FTC by EPIC. It is 
very unfortunate that you did not inform me of this issue. Our customer’s pri- 
vacy and security is very important to us, and we trust our Mall partners to 
maintain the security of our customers. 

I have removed your site, and it will stay offline until this matter with EPIC 
and the FTC is resolved. 24 

The Department of Defense was able, with just a quick review of the privacy 
issues, to determine that this product should not be sold to military families. But 
the Federal Trade Commission, which has the statutory authority and presumably 
the expertise to investigate sucb matters, simply ignored it. 25 

To this date, the FTC has not explained why it failed to take action. 

Updates to COPPA 

One area where there is a clear need to update COPPA concerns the scope of Per- 
sonally Identifiable Information. Under the original rule, traditional categories of 
personal information, such as name, address, phone number and social security 
number are treated as “Personal information.” 26 The Rule also wisely treats per- 
sistent identifiers, such as cookies, as personal information. 27 However, the Rule did 
not anticipate the emergence of the mobile web and location-based services. It is 
possible that such information could be considered as part of the catchall provision, 
section 312.2(g), but the better approach would be to make explicit that location in- 
formation associated with an individual child should be included in the categories 
of personal information. 

We would also recommend that serious consideration be given to raising the age 
of COPPA coverage. This was a hotly debated issue at the time of the law’s enact- 
ment. At the time of introduction, the Children’s Privacy Protection and Parental 
Empowerment Act of 1996, which later became COPPA, set the age requirement at 
16. Eventually, to help ensure passage, the age requirement was dropped to 13. But 
it remains an opportunity, particularly now with the bill up for review, whether the 
privacy obligations should extend to those who are 16 or perhaps even 18. 

Today, I recommend that Congress raise the age requirement in COPPA to 18. 
The emergence of social networks and the powerful commercial forces that are seek- 
ing to extract personal data on all users of these services, but particularly children, 
raise new challenges that the original COPPA simply did not contemplate. To the 
extent that companies choose to collect personal information on children between 13 
and 18, they should be subject to privacy obligations. If they believe that the privacy 


23 Wendy Davis, Company Allegedly Uses Monitoring Software To Collect Data From Children , 
MediaPost News (Sept. 29, 2009), http : / / www.mediapost.com / publications / ?fa=A?'ticles. show 
Article&art — aid=l 14428. The company has since changed its characterization of the Pulse serv- 
ice. 

24 E-mail from Matthew McCoy, AAFES to Kevin Sullivan and Jeffrey Supinsky, Echometrix, 

Oct. 14, 2009 available at http: // epic.org / privacy / echometrix /Excerpts from echometrix 

docs 12-l-09.pdf 

25 Jaikumar Vijayan, DOD nixes vendor of online monitoring software over privacy concerns: 
EchoMetrix suspended from selling products via military’s shopping portal, Computerworld, Dec. 

4, 2009, http:/ / www.computerworld.com / s / article / 9141821 IDOD nixes vendor of online 

monitoring software over privacy concerns. 

26 §312.2 (Definitions). 

27 §312.2®. 
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obligations are too burdensome, the alternative is straightforward: provide an online 
experience that does not require the collection of so much personal data. Innovative 
companies, no doubt, will find clever new business models that respect users’ pri- 
vacy. 

If the Congress chooses not to raise the age on COPPA, then I anticipate that the 
privacy problems will grow more severe in the next few years. Not only will compa- 
nies that target young teens gather more data, their business practices will become 
increasingly more opaque and more difficult for users to manage. We have seen just 
in the last few years how companies such as Facebook have found that they can 
manipulate privacy settings and change privacy policies to coax personal informa- 
tion out of users who had earlier made clear which information they would reveal 
and which information they would keep private. 

There is one proviso for this recommendation. For children in between the ages 
of 13 to 18, I believe that the companies subject to COPPA should have an obliga- 
tion to provide privacy rights directly to the users of their services and not to their 
parents. By this I mean that it is the kids who should be able to learn how their 
personal data is being gathered and object where appropriate. I think this approach 
will encourage teenagers to exercise greater control over their online experience and 
to understand the privacy practices of the companies they deal with. While it is ap- 
propriate that parents make these decisions for younger children, creating privacy 
rights for teenagers is likely to lead to better informed decisions and greater consid- 
eration of privacy interests by companies providing online services. 

The growing concerns about the FTC’s ability to safeguard online privacy raises 
another concern and that is whether the FTC has the authority and the competence 
to address emerging privacy challenges. It is not just in the area of COPPA enforce- 
ment that there are concerns. The FTC has also shown an inability to address such 
important new topics as cloud computing, location privacy, or the broader question 
of the effectiveness of web privacy policies and self-regulation. 

EPIC has had several important complaints pending at the FTC. Whereas pre- 
vious Commissions acted forcefully on the recommendations of consumer privacy 
groups, the current FTC seems unwilling or unable to address the privacy chal- 
lenges that confront users of new services every day. 28 In one particularly egregious 
example, it took the attack on Google in China in January of this year to get the 
company to routinely encrypt Gmail, something that EPIC had specifically rec- 
ommended to the FTC in our March 2009 complaint. 29 

There is another issue I would like to bring your attention to concerning children 
and new technology. While much of COPPA’s focus is understandably directed to- 
ward the Internet and data gathering activity by commercial firms, it is important 
to consider also how new technologies are gathering data on children in public 
spaces and with new communications technologies. There is, for example, the use 
of RIFD technology for identity documents that makes it possible to track and 
record the location of children. Properly implemented there may be some security 
benefits. But there are also substantial risks that should be considered. In one case, 
public objections led a school to drop its plan to require RFID-enabled tags for iden- 
tity documents. 30 

Conclusion 

COPPA was a smart and forward-looking privacy law. It helped slow the commer- 
cialization of personal information concerning children and it promoted safety and 
respect for the treatment of minors using new online services. Around the edges, 
there are understandable questions about application and implementation. Age 
verification continues to be a challenge. But the central purpose — to establish pri- 
vacy safeguards for the collection and use of personal information on children — is 
sensible and important. The critical task now is to carry forward this goal as new 
business practices continue to raise new privacy challenges. 

Thank you for your interest. I will be pleased to answer your questions. 
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Senator Pryor. Thank you. 

Mr. Szoka. 

STATEMENT OF BERIN SZOKA, SENIOR FELLOW 
AND DIRECTOR, CENTER FOR INTERNET FREEDOM, 

THE PROGRESS & FREEDOM FOUNDATION 

Mr. Szoka. Mr. Chairman, Mr. Ranking Member, and Committee 
members, thank you for inviting me here today. 

Despite sitting at the kids’ table, I am a Senior Fellow at The 
Progress & Freedom Foundation. So, you can just imagine how 
young my colleagues must be! 

But, I commend the Committee for studying COPPA, and also 
the Federal Trade Commission, for its review of the COPPA rule, 
which I think is an important distinction we should keep in mind. 

As Ms. Rich explained, for an “Internet junior,” as we have re- 
ferred to it, of sites that are directed to children under 13, COPPA 
requires sites to either age-verify all users or to limit the 
functionality of the site to prevent children from making personal 
information publicly available, including the sharing of user-gen- 
erated content. 

COPPA imposes the same requirement on general audience sites 
when they have actual knowledge that they are collecting informa- 
tion from a user under 13 or, again, enabling them to share infor- 
mation. 

Because of this forced separation and the costs of age 
verification, COPPA may well have unintentionally limited the 
choice and competition in the marketplace for children’s content by 
driving consolidation in that marketplace. 

On the other hand, COPPA has been reasonably successful in 
fulfilling Congress’s original goal of enhancing parental involve- 
ment to protect children’s online privacy and safety. 

Whatever this tradeoff, I am here today to caution against ex- 
panding COPPA beyond its original, limited purpose. COPPA’s 
unique value lies in its flexibility, its subtlety, and its intentional 
narrowness. And my concern here is not just about innovation, but 
also about free speech. 

COPPA is flexible, because it potentially applies the — to the en- 
tire Internet, regardless of the access device used, including serv- 
ices scarcely imaginable in 1998. 

COPPA is subtle, because it requires verifiable parental consent, 
not only if site and service operators gather personal information 
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from kids for their own use, but also if they enable children to 
make that information publicly available online. 

Even more subtle, however, is COPPA’s creative solution to the 
thorny problem of age verification. And, in a nutshell, I would say 
that 13 is just right. Unlike the similarly named Child Online Pro- 
tection Act, or COPA, COPPA requires age verification of users on 
sites clearly directed at children only — and, again, where they have 
actual knowledge; whereas, COPA required age verification of all 
users for any site offering content deemed harmful to minors. 

Back in 1998, Congress considered, but wisely chose not, to apply 
COPPA to adolescents. Unfortunately, recent efforts to expand 
COPPA have put online privacy, child safety, free speech, and ano- 
nymity on a collision course. Several states have proposed what we, 
at PFF, have called “COPPA 2.0 laws,” extending COPPA to ado- 
lescents under 17 or 18. But, once the age threshold rises above 13, 
it becomes increasingly difficult to distinguish sites directed at chil- 
dren below the threshold from general audience sites. With this 
seemingly small change, COPPA would essentially converge with 
COPA. COPPA would extend beyond a discreet Internet junior to 
require age verification for sites used by many adults. And indeed, 
other states have proposed simply extending COPPA to all social 
networking sites. 

But, requiring adults and even older teens to prove their age by 
identifying themselves constitutes a prior restraint on anonymous 
or pseudo anonymous communications. And this would raise the 
same First Amendment concerns that caused the courts to strike 
down COPA. 

Ironically, broader age verification mandates would actually re- 
duce online privacy by requiring more information to be collected, 
both from adolescents and from adults, which would include credit 
card information. While COPPA’s safe harbor is playing a valuable 
part in administering self-regulation under COPPA, government 
shouldn’t put them in the awkward position of becoming reposi- 
tories for huge troves of personal information in the name of pro- 
tecting privacy. 

Nor would COPPA expansion make adolescents safer online. 
Some have argued that age-verification mandates could protect 
children by allowing sites to create safe spaces that exclude preda- 
tors. Unfortunately, the reality is that technology for reliable age 
verification simply does not exist. Even the FTC has made it clear 
that it doesn’t consider COPPA’s verifiable parental consent meth- 
ods, such as the use of a credit card, as equivalent to strict age 
verification. 

COPPA could — expansion could also undermine the viability of 
many online sites and services. As you’ve heard here today, some 
consider the real marketers — excuse me — marketers to be the real 
predators, even though advertising is what we have called “the 
great hidden benefactor” that funds the overwhelming majority of 
free online content and services. COPPA already applies to the col- 
lection of personal information that could potentially allow the con- 
tacting of children under 13, and the Network Advertising Initia- 
tive already requires verifiable parental consent for behavioral ad- 
vertising to children under 13. But, if COPPA were expanded to re- 
quire general audience sites funded by tailored advertising to age- 
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verify all users, it would devolve into the unconstitutional approach 
found in COPPA. 

Importantly, COPPA expansion would also raise costs for smaller 
or new sites and services geared toward minors. And, in turn, this 
could discourage innovation, limit choice, and raise prices for con- 
sumers, and, as I mentioned before, also potentially restrict speech. 

But, ultimately, concerns about tailored advertising may be less 
about privacy or safety than what about — advertising scholar Jack 
Calfee, of the American Enterprise Institute, has called “the fear 
of persuasion,” the idea that advertising is inherently manipula- 
tive, and grows only more so with increased relevance. As he has 
noted, by 10 or so, children have a full understanding of the pur- 
pose of advertising, and, equally important, an active suspicion of 
what advertisers say. If government has a role in — to play in ad- 
dressing concerns about tailored marketing, it lies in educating 
kids about advertising, to help them become smarter consumers. 

Last week, the FTC launched just such an education campaign, 
with its AdMongo tutorial website. The FTC excels in consumer 
education, and should be encouraged in these efforts as a less re- 
strictive alternative to regulation. 

Finally, briefly, I want to caution that H.R. 4173, passed by the 
House in the fall, would give the FTC the capability, even if it 
didn’t intend to do so today, to unilaterally change COPPA, includ- 
ing its age range. And I would simply suggest that such changes 
should be made by Congress, and not the FTC. If Congress wants 
to help the FTC implement COPPA, it should consider additional 
funding for education, and indeed for enforcement. 

Thank you for inviting me to testify. 

[The prepared statement of Mr. Szoka follows:] 

Prepared Statement of Berin Szoka, Senior Fellow and Director, 
Center for Internet Freedom, The Progress & Freedom Foundation 

Mr. Chairman and Committee members, thank you for inviting me here today. 
My name is Berin Szoka. 1 I’m a Senior Fellow at The Progress & Freedom Founda- 
tion (PFF). PFF is a market-oriented think tank and 501(c)(3) non-profit founded 
in 1993 that studies the digital revolution and its implications for public policy. 
PFF’s mission is to educate policymakers, opinion leaders, and the public about 
issues associated with technological change, based on a philosophy of limited gov- 
ernment, free markets, and individual sovereignty. 

I commend this committee for studying the Children’s Online Privacy Protection 
Act or COPPA, and the FTC for its upcoming COPPA Review and Roundtable. 2 My 
colleague Adam Thierer, PFF’s President, has been actively engaged in debates 
about online child safety and privacy since joining PFF in 2005, and is the author 
of Parental Controls & Online Child Protection: Survey of Tools & Methods, a regu- 
larly updated compendium now in its fourth edition and available for free online. 3 
The constant theme in PFF’s work in this area has been to emphasize the tools and 
methods available to parents to control their children’s use of media, including the 
Internet and to the central role played by education efforts in helping both parents 
and children make smarter choices. We also highlight enforcement of existing laws 
as an additional “less restrictive” alternative to new regulation, and attempt to 


1 The views expressed here are his own, and not necessarily the views of the PFF board, other 
fellows or staff. 

2 Federal Trade Commission, Request for Public Comment on the FTC’s Implementation of the 
Children’s Online Privacy Protection Rule, April 5, 2010, http:/ 1 www.ftc.gov I os / 2010 1 03 1 
100324coppa.pdf; see also COPPA Rule Review Roundtable, http: / 1 www.ftc.gov I bcp / workshops I 
coppa / index, shtml. 

3 Adam Thierer, Parental Controls & Online Child Protection: Survey of Tools & Methods, 
Version 4.0, Fall 2008, www.pff.org/parentalcontrols/index.html. 
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highlight the trade-offs involved in imposing new regulation of online communica- 
tions. 

In May 2009, Adam and I published a 35-page paper entitled COPPA 2.0: The 
New Battle over Privacy, Age Verification, Online Safety & Free Speech, providing 
an overview of COPPA, how it works, its costs and benefits, and explaining the dan- 
gers inherent in several then-pending efforts to expand COPPA by expanding the 
law to cover adolescents or all social networking sites. 4 We identified a number of 
legal, technical, and other practical problems with such proposals in that they 
would: 

• Burden the free speech rights of adults by imposing age verification mandates 
on many sites used by adults, thus restricting anonymous speech and essen- 
tially converging — in terms of practical consequences — with the unconstitutional 
Children’s Online Protection Act (COPA), 5 another 1998 law sometimes con- 
fused with COPPA; 

• Burden the free speech rights of adolescents to speak freely on — or gather infor- 
mation from — legal and socially beneficial websites; 

• Hamper routine and socially beneficial communication between adolescents and 
adults; 

• Reduce, rather than enhance, the privacy of adolescents, parents and other 
adults because of the massive volume of personal information that would have 
to be collected about users for authentication purposes (likely including credit 
card data); 

• Would likely be the subject of massive fraud or evasion since it is not always 
possible to definitively verify the parent-child relationship, or because the sys- 
tem could be “gamed” in other ways by determined adolescents; 

• Do nothing to prevent offshore sites and services from operating outside these 
rules; 

• Present major practical challenges for law enforcement officials in the face of 
such evasion by both domestic users and offshore sites; 

• Could destroy opportunities for new or smaller website operators to break into 
the market and offer competing services and innovations, thus contributing to 
consolidation of online content and services by erecting barriers to entry; and 

• Violate the Commerce Clause of the U.S. Constitution if enacted by states, since 
Internet activity clearly represents interstate commerce that states have no au- 
thority to regulate. 

This testimony summarizes the key aspects of that paper, which I attach below 
for the Committee’s convenience, but also provides additional context on subsequent 
developments and related issues. Subsequently, I filed written testimony with the 
Maine Legislature regarding proposals in Maine, including a law enacted over the 
summer but never enforced by the state attorney general, to apply the COPPA 
framework to the collection of health-related information from adolescents. 6 We also 
look forward filing comments in the FTC’s upcoming COPPA Review. 

COPPA can best be summarized as follows: For an “Internet Jr.” of sites “directed 
at” children under 13, COPPA requires sites either to age-verify all users or limit 
functionality to prevent children from making personal information “publicly avail- 
able” — including the sharing of user-generated content. COPPA imposes the same 
requirement on general audience sites when they have actual knowledge a user is 
under 13. 

The Costs of COPPA 

Because of this forced separation and the costs of age verification, COPPA may 
well have unintentionally limited choice and competition by driving increased con- 
solidation in the marketplace for child-oriented sites and services online and dis- 
couraging new entry by smaller “mom-and-pop” sites that could cater to children. 
As early as 2001, even some Congressmen recognized this “unintended consequence” 


4 Berin Szoka & Adam Thierer, COPPA 2.0: The New Battle over Privacy, Age Verification, 
Online Safety & Free Speech , Progress on Point 16.11, May 2009, http://pff.org/issues-pubsl 
pops /2009 / popl 6.11 -COPPA-and-age-verification.pdf. 

5 47 U.S.C. §231. While COPPA governs sites “directed at” children, COPA would have re- 
quired age verification for content deemed "harmful to minors.” COPA has been struck down 
on First Amendment grounds. 

6 Berin Szoka, Written to Maine Legislature on Act to Protect Minors from Pharmaceutical 
Marketing Practices, LD 1677, March 4, 2010, www.pff.org / issues-pubs / filings / 2010 1 2010-03- 
04-Maine Law Testimony.pdf. 
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of COPPA in Congressional hearings on privacy. 7 There are significant costs associ- 
ated with the verifiable parental consent methods used to comply with COPPA. Of 
course, it could be the case that there are other reasons that there are relatively 
few sites catering exclusively to children. But this is a question worth considering, 
and the FTC deserves credit for beginning its COPPA review with this question. 8 
As noted by Parry Aftab, Executive Director of the children’s advocacy group Wired 
Safety, “COPPA wasn’t responsible for the demise of these sites, but when combined 
with the other factors [it] tipped the balance.” 9 She concludes, appropriately: 

It is crucial that at this tentative stage for the kids Internet industry we don’t 
do anything to make its survival more difficult. We should be looking at easy 
to encourage safer communities for preteens and innovations to help create fun, 
entertaining and educational content for kids online. 10 

The Success of COPPA 

On the other hand, COPPA has been reasonably successful in fulfilling Congress’s 
original goals, as expressed by the law’s Congressional sponsors: 

(1) to enhance parental involvement in a child’s online activities in order to pro- 
tect the privacy of children in the online environment; (2) to enhance parental 
involvement to help protect the safety of children in online fora such as 
chatrooms, home pages, and pen-pal services in which children may make pub- 
lic postings of identifying information; (3) to maintain the security of personally 
identifiable information of children collected online; and (4) to protect children’s 
privacy by limiting the collection of personal information from children without 
parental consent. 11 

Thus, as its name implies, COPPA is first and foremost about protecting the pri- 
vacy of children. COPPA’s primary means for achieving this goal is enhancing pa- 
rental involvement or, as the FTC has put it, “providfing] parents with a set of effec- 
tive tools . . . for becoming involved in and overseeing their children’s interactions 
online.” 12 However admirable, “protect[ing] the safety of children” is merely an indi- 
rect goal of COPPA — something to be achieved through the means of enhancing pa- 
rental involvement (COPPA’s direct goal). The FTC declares that COPPA “has pro- 
vided a workable system to help protect the online safety and privacy of the Inter- 
net’s youngest visitors.” 13 

Indeed, COPPA may succeed in achieving its original purpose of enhancing paren- 
tal involvement, but strict age verification mandates intended to go beyond COPPA 
will ultimately fail because kids will simply lie to circumvent age verification re- 
quirements. As Microsoft researcher Danah Boyd has put it, “COPPA did not stop 
most children from creating accounts, but it did teach children and their parents 
an important lesson: Lying is the path to access.” 14 Even though “there is no perfect 
solution” and it is not possible to completely “stop a child from lying and putting 
themselves at risk,” Denise Tayloe of Privo, one of the four FTC-approved providers 
of COPPA safe harbor age verification services, believes that COPPA “provides a 
platform to educate parents and kids about privacy.” 15 


7 Rep. Billy Tauzin (R-LA) noted that COPPA “has now forced companies to discontinue a 
number of products targeted toward children” and asked “If we end up forcing private compa- 
nies and nonprofits to eliminate beneficial products such as crime prevention material, have we 
done a good thing? If teen-friendly sites, those that totally respect the privacy of the users stop 
offering e-mail services to children, is that a good thing? An Examination of Existing Federal 
Statutes Addressing Information Privacy: Hearing of the House Committee On Energy and Com- 
merce, 107th Cong. 6 (April 3, 2001) (statement of Rep. Tauzin.), available at http: / / repub- 
licans. energycommerce.house.gov / 1 07 1 action / 1 07-22.pdf. 

8 Federal Trade Commission, Request for Public Comment on the FTC’s Implementation of the 
Children’s Online Privacy Protection Rule, at 2 April 5, 2010, http : / / www.ftc.gov / os / 2010 / 03 / 
1 00324coppa.pdf. 

9 Comments of Parry Aftab, Request for Public Comment on the Implementation of COPPA and 
COPPA Rule’s Sliding Scale Mechanism for Obtaining Verifiable Parental Consent Before Col- 
lecting Personal Information from Children at 3, June 27, 2005, www.ftc.gov / os / comments / 
COPPArulereview / 51 6296-00021.pdf. 

10 Id. 

11 144 Cong. Rec. S11657 (daily ed. Oct. 7, 1998) (statement of Rep. Bryan). 

12 Federal Trade Commission, Implementing the Children’s Online Privacy Protection Act: A 

Report to Congress at 28, Feb. 2007, www.ftc.gov/reports/coppa/07COPPA Report to 

Congress.pdf. 

13 Id. 

14 Danah Michele Boyd, Taken Out of Context American Teen Sociality in Networked Publics, 
at 151 Fall 2008, www.danah.org/papers/TakenOutOfContext.pdf 

15 E-mail from Denise Tayloe to Adam Thierer (Mar. 15, 2007) (copy on file with author). 
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Especially given this practical limitation and whatever the trade-offs involved in 
COPPA, I’m here today to caution against expanding COPPA beyond its original, 
limited purpose. COPPA’s unique value lies in its flexibility, subtlety, and inten- 
tional narrowness. 

COPPA is Flexible Enough to Cover a Rapidly Changing Landscape 

COPPA is flexible because it potentially applies to the entire Internet regardless 
of the access device used — including services scarcely imaginable in 1998. Specifi- 
cally, COPPA applies to any “operator,” which the statute defines to mean: 

any person who operates a website located on the Internet or an online service 
and who collects or maintains personal information from or about the users of 
or visitors to such website or online service, or on whose behalf such informa- 
tion is collected or maintained, where such website or online service is operated 
for commercial purposes, including any person offering products or services for 
sale through that website or online service, involving commerce. 16 

COPPA defines the key term “Internet” broadly to mean: 

collectively the myriad of computer and telecommunications facilities, including 
equipment and operating software, which comprise the interconnected world- 
wide network of networks that employ the Transmission Control Protocol/ Inter- 
net Protocol, or any predecessor or successor protocols to such protocol, to com- 
municate information of all kinds by wire or radio. 17 

In interpreting its COPPA Rule, the FTC has said: 

The Rule’s Statement of Basis and Purpose makes clear that the term Internet 
is intended to apply to broadband networks, as well as to intranets maintained 
by online services that either are accessible via the Internet, or that have gate- 
ways to the Internet. 18 

Because nearly all communications platforms have converged on the “Internet,” 
thus defined, COPPA would reach a wide variety of services and media not com- 
monly thought of as belonging to the “Internet.” For example, if a video game con- 
sole is networked through the Internet to allow users to play games with each other, 
COPPA would apply to potential sharing of personal information. To this extent, the 
FTC ought not need new statutory authority from Congress. 

COPPA’s Subtlety Lies in its Narrowness 

COPPA is subtle because it requires “verifiable parental consent” not only if site 
and service operators gather personal information from kids for their own use, but 
also if sites enable children to make personal information “publicly available” on- 
line. Even more subtle is COPPA’s creative solution to the thorny problem of age 
verification. Unlike the similarly-named Child Online Protection Act of 1998 (COPA, 
pronounced “koh-pah” instead of “kah-pah”), 19 COPPA only requires age verification 
of users onsites clearly directed at children, whereas COPA required it for any site 
offering content deemed “harmful to minors.” 

Efforts to Expand COPPA Raise Serious First Amendment Concerns 

Back in 1998, Congress wisely chose not to apply COPPA to adolescents. Unfortu- 
nately, recent efforts to expand COPPA have put online privacy, child safety, free 
speech and anonymity on a collision course. Several states have proposed wbat we 
at PFF have called “COPPA 2.0” laws, extending COPPA to adolescents up to 17 
or 18. But once the age threshold rises above 13, it becomes increasingly difficult 
to distinguish sites “directed at” children below the threshold from general audience 
sites. With this seemingly small change, COPPA would essentially converge with 
COPA: COPPA would extend beyond a discrete “Internet, Jr.” to require age 
verification for sites used by many adults — and, indeed, other states have proposed 
simply extending COPPA to all social networking sites. But requiring adults and 
even older teens to prove their age by identifying themselves constitutes a prior re- 
straint on anonymous or pseudonymous communication. This raises the same First 
Amendment concerns that caused the courts to strike down COPA. 

After a decade-long court battle over COPA’s constitutionality, the U.S. Supreme 
Court in January 2009 rejected the government’s latest request to revive the law, 


16 15 U.S.C. §6501(2). 

17 15 U.S.C. §6501(6). 

18 Federal Trade Commission, Frequently Asked Questions about the Children’s Online Privacy 
Protection Rule, Question 6 (“What types of online transmissions does COPPA apply to?”), 
www.ftc.gov / privacy / coppafaqs.shtm . 

19 47 U.S.C. §231. 
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meaning it is likely dead. 20 Three of the key reasons the courts struck down COPA 
would also apply to COPPA 2.0 proposals: 

• Anonymous Speech Rights of Adults. COPA burdened the speech rights of adults 
to access information subject to age verification requirements, both by making 
speech more difficult and by stigmatizing it. In 2003, the Third Circuit noted 
that age verification requirements “will likely deter many adults from accessing 
restricted content, because many Web users are simply unwilling to provide 
identification information in order to gain access to content, especially where 
the information they wish to access is sensitive or controversial.” 21 The Su- 
preme Court has recognized the vital importance of anonymous speech in the 
context of traditional publication. 22 By imposing broad age verification require- 
ments, COPPA 2.0 would restrict the rights of adults to send and receive infor- 
mation anonymously just as COPA did. If anything, the speech burdened by 
COPPA 2.0 deserves more protection, not less, than the speech burdened by 
COPA: Where COPA merely burdened access to content deemed “harmful to mi- 
nors” (viz., pornography), COPPA 2.0 would burden access to material by adults 
as well as minors not because that material is harmful or obscene but merely 
because it is “directed at” minors! Thus, the content covered by COPPA 2.0 pro- 
posals could include not merely pornography, but communications about polit- 
ical nature, which deserved the highest degree of First Amendment protection. 

• Speech Rights of Site Operators. The necessary corollary of blocking adults from 
accessing certain content anonymously — and thereby deterring some users from 
accessing that content — is that COPPA 2.0 proposals would, like COPA, nec- 
essarily reduce the audience size of websites subject to age verification man- 
dates. Furthermore, such mandates would encourage websites to self-censor 
themselves to avoid offering content they fear could be considered “directed at” 
adolescents because doing so might subject them to an age verification man- 
date — or to legal liability if they fail to implement age verification. The substan- 
tial cost of age verification could significantly impact, if not make impossible, 
sites that allow sharing of personal information, including user-generated con- 
tent, because such sites generally do not charge for content and rely instead on 
advertising revenues. The Third Circuit cited all of these burdens on the free 
speech rights of website operators in striking down COPA. 23 

• Less Restrictive Alternatives to Regulation. The Third Circuit drew on the Su- 
preme Court’s 2004 decision striking down COPA on the grounds that 
“[bjlocking and filtering software is an alternative that is less restrictive than 
COPA, and, in addition, likely more effective as a means of restricting children’s 
access to materials harmful to them.” 24 Similarly, parental control software al- 
ready empowers parents to restrict their kids’ access to sites that “collect” per- 
sonal information. It’s particularly easy for parents to restrict access to the 
leading social networking sites that seem to be driving so much of the push for 
COPPA 2.0. 

COPPA Expansion Would Undermine Privacy 

Ironically, broad age verification mandates would reduce online privacy by requir- 
ing more information to be collected from both adolescents and adults, including 
credit card information, in order to verify age and the parent/child relationship (in 
the admittedly imperfect fashions prescribed by COPPA’s “Sliding Scale”). While 
COPPA’s safe harbor administrators play a valuable role in administering self-regu- 
lation under COPPA, 25 government shouldn’t put them in the awkward position of 


20 See Adam Thierer, The Progress & Freedom Foundation, Closing the Book on COPA, PFF 

Blog, Jan. 21, 2009, httv:l j hlog.yff.org / archives / 2009 / 01 / closing the boo.html. See also Alex 

Harris, Child Online Protection Act Still Unconstitutional, http: / / cyberlaw.stanford.edu / packet / 
200811 /child-online-protection-act-still-unconstitutional. 

21 American Civil Liberties Union v. Ashcroft, 322 F.3d 240, 259 (3d Cir. 2003). 

22 McIntyre v. Ohio Elections Commit, 514 U.S. 334, 342 (1995) (striking down law that pro- 
hibited distribution of anonymous campaign literature); see also Talley v. California, 362 U.S. 
60 (I960) (striking down a state law that forbade all anonymous leafletting). 

23 See ACLU III, 534 F.3d at 196-97 (citing ACLU v. Gonzales, 478 F. Supp. 2d 775, 804). 
The Court held that websites “face significant costs to implement [COPA’s age verification man- 
dates] and will suffer the loss of legitimate visitors once they do so.” Id. at 197. 

24 Id. at 198 (quoting ACLU v. Mukasey, 534 F.3d 181, 198 (2008)). 

25 The four safe harbor programs are administered by the Children’s Advertising Review Unit 
of the Council of Better Business Bureaus (CARU); the Entertainment Software Rating Board 
(ESRB); TRUSTe; and Privo. See Federal Trade Commission, Safe Harbor Program, www.ftc 
.gov / privacy / privacyinitiatives / childrens shp.html. 
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becoming repositories for huge troves of personal information in the name of pro- 
tecting privacy. 

COPPA Expansion Would Not Enhance Child Safety 

Some have argued that age verification mandates could protect children by allow- 
ing sites to create “safe spaces” that exclude predators. Unfortunately, the reality 
is that the technology for reliable age verification simply doesn’t exist. 

Federal courts have found that there is “no evidence of age verification services 
or products available on the market to owners of websites that actually reliably es- 
tablish or verify the age of Internet users. Nor is there evidence of such services 
or products that can effectively prevent access to Web pages by a minor.” 26 Few 
public data bases exist that could be referenced to conduct such verifications for mi- 
nors, and most parents do not want the few records that do exist about their chil- 
dren le.g., birth certificates, Social Security numbers, school records) to become more 
easily accessible. 27 Indeed, concerns about those records being compromised or fall- 
ing into the wrong hands have led to legal restrictions on their accessibility. 28 Even 
the FTC has made clear that it doesn’t consider COPPA’s “sliding scale” of verifiable 
parental consent methods — use of a credit card, print-and-fax forms, follow-up phone 
calls and e-mails, and using encryption certificates 29 — as equivalent to strict age 
verification. 30 

Fears of Advertising Should Not Drive COPPA Expansion 

COPPA expansion could also undermine the viability of many online sites and 
services. Some consider marketers the “real predators” — even though advertising is 
the great “Hidden Benefactor” 31 that funds the overwhelming majority of “free” 
Internet content and services. COPPA already applies to the collection of informa- 
tion that could potentially allow the contacting of a child under 13. The Network 
Advertising Initiative already requires verifiable parental consent for behavioral ad- 
vertising to children under 13. But if COPPA were expanded to require general au- 
dience sites funded by tailored advertising to age-verify all users, it would devolve 
into the unconstitutional approach found in COPA. Importantly, COPPA expansion 
would also raise costs for smaller or new sites and services geared toward minors. 
This could discourage new innovation, limit choice, and raise prices for consumers. 32 

Ultimately, concerns about tailored advertising may be less about privacy than 
about what advertising scholar Jack Calfee has dubbed the “Fear of Persuasion” — 
the idea that advertising is inherently manipulative and only grows more so with 
increased relevance. But as Calfee notes, “by the age 10 or so, children develop a 
full understanding of the purpose of advertising and equally important, an active 
suspicion of what advertisers say.” 33 If government has a role to play in addressing 
concerns about tailored marketing, it lies in educating kids about advertising to help 
them become smarter consumers. Last week, the FTC launched just such an edu- 


26 Gonzales, 478 F. Supp. 2d at 806. 

27 See Adam Thierer, The Progress & Freedom Foundation, Age Verification Debate Continues; 

Schools Now at Center of Discussion, PFF Blog, Sept. 25, 2008, http: / lblog.pff.org / archives / 
2008 1091 age verificatio l.html. 

28 Various laws and regulations have been implemented that shield such records from public 
use, including various state statutes and the Family Educational Rights and Privacy Act of 
1974, 20 U.S.C. § 1232g, www.ed.gov/policy/gen/guid/fpco/ferpa/index.html. 

29 16 C.F.R. § 312.5(b)(2). 

30 In a February 2007 report to Congress about the status of the law and its enforcement, the 
FTC said that no changes to COPPA were then necessary because the law had “been effective 
in helping to protect the privacy and safety of young children online.” Federal Trade Commis- 
sion, Implementing the Children’s Online Privacy Protection Act: A Report to Congress at 1, 

Feb. 2007, www.ftc.gov/reports/coppa/07COPPA Report to Congress.pdf In discussing the 

effectiveness of the parental consent verification methods authorized in the FTC’s sliding scale 
approach, however, the agency acknowledged that "none of these mechanisms is foolproof.” Id. 
at 13. The FTC attempts to distinguish these parental consent verification methods from other 
kinds of age verification tools in noting that "age verification technologies have not kept pace 
with other developments, and are not currently available as a substitute for other screening 
mechanisms.” Id. at 12. 

31 Adam Thierer & Berin Szoka, The Hidden Benefactor: How Advertising Informs, Educates 
& Benefits Consumers, Progress on Point 6.5, Feb. 2010, www.pff.org/issues-pubslps/2010lpdfl 
ps6.5-the-hiddenbenefactor.pdf. 

32 In 2005, the FTC has cited an estimate of $45/child as the cost of obtaining verifiable paren- 
tal consent for child-oriented sites to comply with COPPA. See Comments of Parry Aftab, Re- 
quest for Public Comment on the Implementation of COPPA and COPPA Rule’s Sliding Scale 
Mechanism for Obtaining Verifiable Parental Consent Before Collecting Personal Information 
from Children at 2, June 27, 2005, www.ftc.gov/os/comments/COPPArulereview/516296- 
00021.pdf. 

33 Jack Calfee, American Enterprise Institute, Fear of Persuasion: A New Perspective on Ad- 
vertising and Regulation, 59 (1997). 
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cation campaign with its AdMongo tutorial website ( www.admongo.gov ). 34 The FTC 
excels in consumer education, and should be encouraged in these efforts as a less 
restrictive alternative to regulation. Other excellent examples of FTC education ef- 
forts include: 

OnGuardOnline.gov (tips on online security, fraud avoidance and privacy); 
NetCetera: Chatting With Kids About Being Online (www.onguardonline.gov / 
topics / netcetera.aspx); and 

You Are Here: Where Kids Learn to be Smarter Consumers ( ftc.gov / youarehere / 

). 

Opening the Door to COPPA Expansion through FTC Overhaul via 
Financial Reform 

Finally, financial reform legislation recently passed by the House would give the 
FTC sweeping new rulemaking powers, and could allow the FTC to unilaterally 
change COPPA, including its age range. Specifically, H.R. 4173 would give the FTC 
normal rulemaking authority under the Administrative Procedures Act, replacing 
the special rulemaking procedures crafted by Congress with the 1975 Magnuson- 
Moss Act, and strengthened through additional procedural safeguards in 1980, to 
ensure that the agency did not rush into preemptive regulation without carefully 
weighing the costs and benefits of government intervention. 35 

Such decisions should be made by Congress, not the FTC. If Congress wants to 
help the FTC implement COPPA, it should consider additional funding for education 
and enforcement. These, in conjunction with empowerment of parents and kids to 
manage their own privacy and other online preferences, offer a better approach to 
addressing concerns about online child privacy and safety than increased regulation. 

Thank you again for inviting me to testify. 
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COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & 

Free Speech 

by Berin Szoka & Adam Thierer 

Executive Summary 

Online privacy, child safety, free speech and anonymity are on a collision course. 
The 1998 Children’s Online Privacy Protection Act (COPPA) already mandates cer- 
tain online privacy protections for children under 13, but many advocate expanding 
online privacy protections for both adolescents and adults. Furthermore, efforts con- 
tinue at both the Federal and state levels to institute new regulations, such as age 
verification mandates, aimed at ensuring the safety of children online. There is an 
inherent tension between these objectives: Attempts to achieve perfectly “safe” on- 
line environments will likely require the surrender of some privacy and speech 
rights, including the right to speak anonymously. 

These tensions are coming to a head with state-based efforts to expand COPPA, 
which requires “verifiable parental consent” before certain sites or services may col- 
lect, or enable the sharing of, personal information from children under the age of 
13. Several proposed state laws would extend COPPA’s parental-consent framework 
to cover all adolescents under 18. This seemingly small change would require age 
verification of not only adolescents and their parents, but — for the first time — large 
numbers of adults, thus raising grave First Amendment concerns. Such broad age 
verification mandates would, ironically, reduce online privacy by requiring more in- 
formation to be collected from both adolescents and adults for age verification pur- 
poses, while doing little to make adolescents safer. In practical terms, the increased 
scale of “COPPA 2.0” efforts would present significant implementation and enforce- 
ment challenges. Finally, state-level COPPA 2.0 proposals would likely conflict with 
the Constitution’s Commerce Clause. 

Despite these profound problems, COPPA expansion has great rhetorical appeal 
and seems likely to be at the heart of future child safety debates — especially efforts 
to require mandatory age verification. There are, however, many better ways to pro- 
tect children online than by expanding COPPA beyond its original, limited purpose. 

I. Introduction 

When the debate about social networking safety first heated up a few years ago, 
some state attorneys general (AGs) and vendors of age verification services implied 
that the technology existed — or could be easily developed — to verify the age of any 
minor who sought access to an interactive website. 1 Federal law currently re- 
quires — via the Children’s Online Privacy Protection Act (COPPA) of 1998 2 — that 
child-oriented website operators or service providers “Obtain verifiable parental con- 
sent prior to any collection, use, and/or disclosure of personal information from chil- 
dren [under 131.” 3 But advocates of age verification mandates have argued that on- 
line child safety would be improved if websites — particularly “social networking 
sites” like MySpace, Facebook and Bebo — were required to do more: screen users by 
age and to limit or ban access by those over, or under, a certain age. 

Today, however, the practical limitations and dangers of age verification man- 
dates have become more widely recognized. Few continue to argue for directly man- 
dating verification of the age of minors online — or that such verification, in its 
strictest sense, is even technically feasible. Federal courts have found that there is 
“no evidence of age verification services or products available on the market to own- 
ers of websites that actually reliably establish or verify the age of Internet users. 
Nor is there evidence of such services or products that can effectively prevent access 
to Web pages by a minor.” 4 Few public data bases exist that could be referenced 
to conduct such verifications for minors, and most parents do not want the few 
records that do exist about their children ( e.g birth certificates, Social Security 


1 See. e.g., Emily Steel & Julia Angwin, MySpace Receives More Pressure to Limit Children’s 
Access to Site, Wall Street Journal, June 23, 2006, http :/ / online.wsj.com / public / article / 
SB1151022684452882B0-YRxkt0rTsyyflQiQf2EPBYSf7iU_20070624.html. 

2 15 U.S.C. §§6501-6506. 

3 See 16 C.F.R. §312.5. See infra at 6 and note 25 for a discussion of COPPA’s other require- 
ments, particularly that COPPA applies if a website has “actual knowledge” that it is collecting 
information from a child even if the website is not “directed at” children. 

4 ACLU v. Gonzales, 478 F. Supp. 2d 775, 806 (E.D. Pa. 2007) [hereinafter Gonzales]; see infra 
at 28. 
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numbers, school records) to become more easily accessible. 5 Indeed, concerns about 
those records being compromised or falling into the wrong hands have led to legal 
restrictions on their accessibility. 6 

There are a host of other concerns about age verification mandates. 7 Some of 
these concerns were summarized in a recent report produced by the Internet Safety 
Technical Task Force, a blue ribbon task force assembled in 2008 by state AGs to 
study this issue: 

Age verification and identity authentication technologies are appealing in con- 
cept but challenged in terms of effectiveness. Any system that relies on remote 
verification of information has potential for inaccuracies. For example, on the 
user side, it is never certain that the person attempting to verify an identity 
is using their own actual identity or someone else’s. Any system that relies on 
public records has a better likelihood of accurately verifying an adult than a 
minor due to extant records. Any system that focuses on third-party in-person 
verification would require significant political backing and social acceptance. 
Additionally, any central repository of this type of personal information would 
raise significant privacy concerns and security issues. 8 

With opposition to strict age verification mandates growing, some regulatory advo- 
cates now seek to institute such mandates through the back door of “parental con- 
sent” mandates in the model of COPPA. Such “COPPA 2.0” legislation has been in- 
troduced at the state level that would extend the COPPA parental-consent frame- 
work to cover all minors between the ages of 13 and 17 inclusive (“adolescents”). 
Some of these bills would also broaden the range of sites covered, increase the 
amount of information required to be collected to achieve “verifiable parental con- 
sent” or impose other mandates such as parental access. 

Two such bills were introduced in 2007, in North Carolina (with the support of 
that state’s Attorney General Roy Cooper) 9 and Georgia. 10 While these bills were 
never passed, a similar bill is currently pending in Illinois. 11 Because the scope of 
such bills would reach all “social networking sites” that offered certain functionality 
(e.g., user profiles), rather only those sites directed at a particular age bracket (as 
under COPPA), 12 they would extend age verification mandates far beyond sites that 
might be considered “adolescent-oriented.” Another bill is currently pending in New 
Jersey; like COPPA, this bill would reach only sites directed at adolescents, but it 
might reach a broader range of sites, because its scope is not limited specifically to 


5 See Adam Thierer, The Progress & Freedom Foundation, Age Verification Debate Continues; 

Schools Now at Center of Discussion, PFF Blog, Sept. 25, 2008, http : / lblog.pff.org / archives l 
2008/091 age verificatio l.html. 

6 Various laws and regulations have been implemented that shield such records from public 
use, including various state statutes and the Family Educational Rights and Privacy Act of 
1974, 20 U.S.C. § 1232g, www.ed.gov/policy/gen/guid/fpco/ferpa/index.html. 

7 For a fuller exploration of these issues, see Adam Thierer, The Progress & Freedom Founda- 
tion, Social Networking and Age Verification: Many Hard Questions; No Easy Solutions, 
Progress on Point No. 14.5, Mar. 2007; Adam Thierer, The Progress & Freedom Foundation, 
Statement Regarding the Internet Safety Technical Task Force’s Final Report to the Attorneys 
General, Jan. 14, 2008, www.pff.org / issues-pubs / other / 0901 14ISTTFthiererclosingstatement.pdf; 
Nancy Willard, Why Age and Identity Verification Will Not Work — And is a Really Bad Idea, 
Jan. 26, 2009, www.csriu.org/PDFs/digitalidnot.pdf; Jeff Schmidt, Online Child Safety: A Secu- 
rity Professional’s Take, The Guardian, Spring 2007, www.jschmidt.org/AgeVerification/ 
Gardian_JSchmidt.pdf. 

8 Internet Safety Technical Task Force, Enhancing Child Safety & Online Technologies: Final 
Report of the Internet Safety Technical Task Force to the Multi-State Working Group on Social 
Networking of State Attorneys General of the United States, Dec. 31, 2008, at 10, http: / / 
cyber.law.harvard.edu/pubrelease /isttf [hereinafter ISTTF Final Report]. Full disclosure: Adam 
Thierer was a member of this task force. 

9 S.B. 132, 2007 Gen. Assem., Reg. Sess. §8 (N.C. 2007), available at www.ncga.state.nc.us/ 
Sessions / 2007 / Bills I Senate I HTML / S132v3.html; see also Roy Cooper, Protecting Children from 
Sexual Predators: SB 132, July 24, 2007, www.ncdoj.com/DocumentStreamerClient/directory 
=WhatsNew / &file=S132%20summary%20final.pdf; see also Adam Thierer, The Progress & Free- 
dom Foundation, Age Verification Showdown in North Carolina, PFF Blog, July 26, 2007, 
http. j / blog.pff.org/archives 12007 107/ age verificatio.html. 

10 S.B. 59, Gen. Assem., 2007-2008 Leg. Sess. (Ga. 2007), available at www.legis.ga.gov/legis/ 
2007 08 j fulltext / sb59.htm. 

1:t H.B. 1312, 96th Gen. Assem., Synopsis as Introduced (II. 2007) [hereinafter SNWARA], 
available at www.ilga.gov /legislation / billstatus.asp?DocNum=1312&GAID=10&GA=96&Doc 
TypeID=HB&LegID=43038&SessionID=76. 

12 See infra note 22 and associated text (noting that that COPPA also applies in cases of “ac- 
tual knowledge,” even if a site is not “directed at” children); see also infra Section V.A. (dis- 
cussing the meaning of “directed at”). 
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“social networking” functionality. 13 The introduction of these bills makes it clear 
that future online identity verification debates will be increasingly tied up with ef- 
forts to expand the COPPA framework. These mandates will likely arrive in the 
form of state-level expansions of, or Federal amendments to, COPPA, or such pro- 
posals will at least cite COPPA’s regulatory framework as precedent. Yet COPPA 
2.0 advocates seem to forget that, back in 1998, Congress considered, but ultimately 
rejected, a requirement in the original version of COPPA that operators make “rea- 
sonable efforts to provide the parents with notice and an opportunity to prevent or 
curtail the collection or use of personal information collected from children over the 
age of 12 and under the age of 17.” 14 This requirement would have been signifi- 
cantly less burdensome than the COPPA 2.0 approaches advanced today, but it was 
stricken from the final version of COPPA after likely constitutional and practical 
problems were identified. 15 

Today’s COPPA 2.0 bills are fraught with even greater legal, technical, and other 
practical problems in that they would: 

• Burden the free speech rights of adults by imposing age verification mandates 
on many sites used by adults, thus restricting anonymous speech and essen- 
tially converging — in terms of practical consequences — with the unconstitutional 
Children’s Online Protection Act (COPA), 16 another 1998 law sometimes con- 
fused with COPPA; 

• Burden the free speech rights of adolescents to speak freely on — or gather infor- 
mation from — legal and socially beneficial websites; 

• Hamper routine and socially beneficial communication between adolescents and 
adults; 

• Reduce, rather than enhance, the privacy of adolescents, parents and other 
adults because of the massive volume of personal information that would have 
to be collected about users for authentication purposes (likely including credit 
card data); 

• Would likely be the subject of massive fraud or evasion since it is not always 
possible to definitively verify the parent-child relationship, or because the sys- 
tem could be “gamed” in other ways by determined adolescents; 

• Do nothing to prevent offshore sites and services from operating outside these 
rules; 

• Present major practical challenges for law enforcement officials in the face of 
such evasion by both domestic users and offshore sites; 

• Could destroy opportunities for new or smaller website operators to break into 
the market and offer competing services and innovations, thus contributing to 
consolidation of online content and services by erecting barriers to entry; and 

• Violate the Commerce Clause of the U.S. Constitution, since Internet activity 
clearly represents interstate commerce that states have no authority to regu- 
late. 

There are better approaches to protect adolescents that do not implicate the seri- 
ous legal and societal issues raised by COPPA 2.0 efforts. 17 Attempts to expand 
COPPA to cover adolescents are thus unnecessary and misguided and should be re- 
jected at both the state and Federal levels. 

The FTC should consider carefully the limitations of COPPA and the pitfalls of 
COPPA 2.0 as the agency prepares to begin an expedited review of COPPA (five 
years ahead of schedule). 18 


13 A.B. 108, Gen. Assem., 213th Leg. Sess. (N.J. 2008) [hereinafter AOPPA], available at 
www.njleg.state.nj. us / 2008 / Bills / A0500 / 108 Il.HTM. 

14 Children’s Online Privacy Protection Act, S. 2326, 105th Cong. §3(a)(2)(iii) (1998). 

15 Testimony of Deirdre Mulligan, Staff Counsel, Center for Democracy and Technology, before 
the Senate Committee on Commerce, Science, and Transportation Subcommittee on Communica- 
tions, Sept. 23, 1998, available at www.cdt.org/testimony/980923mulligan.shtml [hereinafter 
Mulligan Testimony 1. 

16 47 U.S.C. §231. While COPPA governs sites “directed at” children, COPA would have re- 
quired age verification for content deemed "harmful to minors.” COPA has been struck down 
on First Amendment grounds. See infra at Section VI. 

17 See generally Adam Thierer, The Progress & Freedom Foundation, Parental Controls and 
Online Child Protection: A Survey of Tools and Methods, Special Report, Version 3.1, Fall 2008, 
www.pff.org/parentalcofitrols/index.html (cataloguing the tools and methods available to par- 
ents to control their kids’ Internet use). 

18 Howard Buskirk & Yu-Ting Wang, FTC to Expedite Review of Children’s Online Privacy 
Protection Rule, Communications Daily, April 23, 2009, at 5—7. 
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Before examining in greater detail the problems posed by COPPA 2.0 proposals 
(Sections IV-VIII), we review how COPPA 1.0 currently works (Section II) and what 
it achieves (Section III). 

II. Current Implementation of COPPA 

Terminology 

“Adult” — Anyone 18 and over 

“Minor” — Anyone under 18 

“Child” — Anyone under 13 

“Adolescent” — Anyone 13 or over but less than 18 

“Kid” — Because of the specific meaning of “child” under COPPA, we have used 
“kid” instead of “child” when discussing interaction with parents and as a colloquial 
catch-all where appropriate. 

“PI -collecting site” — Any site that collects what COPPA considers “personal infor- 
mation,” which includes contact information. 

“Social networking site” — A generic term for a Pi-collecting site focused on user 
profiles and connections among users. Some legislative proposals use this term to 
refer to sites with specific functionality. 

COPPA generally requires that commercial operators of websites and services ob- 
tain “verifiable parental consent” before collecting, disclosing or using “personal in- 
formation” ( e.g ., name, contact information) 19 about children under 13 20 if either (i) 
their website or service (or “portion thereof’) is “directed at children” 21 or (ii) they 
have actual knowledge that they are collecting personal information from a child. 22 
Even if sites and services that collect personal information (“Pi-collecting sites” 23 ) 
are not “directed at” children, they must still have such a process in place to deal 
with cases in which a child has disclosed that they are under 13. The FTC has de- 
fined COPPA’s scope so broadly that it could apply even to virtual worlds and multi- 
player online games {e.g., Second Life, World of Warcraft). 24 COPPA also requires 
certain notices about information collection, parental access to information collected 
about children, reasonable data security procedures, and restrictions on the collec- 
tion of personal information through games and prizes. 25 


19 The FTC has defined “personal information” to include: 

(a) A first and last name; (b) A home or other physical address including street name and 
name of a city or town; (c) An e-mail address or other online contact information, including but 
not limited to an instant messaging user Identifier, or a screen name that reveals an individ- 
ual’s e-mail address; (d) A telephone number; (e) A Social Security number; (f) A persistent iden- 
tifier, such as a customer number held in a cookie or a processor serial number, where such 
identifier is associated with individually identifiable information; or a combination of a last 
name or photograph of the individual with other information such that the combination permits 
physical or online contacting; or (g) Information concerning the child or the parents of that child 
that the operator collects online from the child and combines with an identifier described. 

16 C.F.R. §312.2. 

20 The word “child” is sometimes used interchangeably with the legal term “minor” (someone 
under 18) in Federal law. See, e.g., 18 U.S.C. §2256(1) (defining “minor” as “any person under 
the age of eighteen years”) and 18 U.S.C. §2256(8) (defining “child pornography” as “any visual 
depiction ... of sexually explicit conduct [involving a minorl”). In common speech, the term 
“child” is often used to mean “a son or daughter of any age.” Dictionary.com, “child,” Merriam- 
Webster’s Dictionary of Law, dictionary .reference.com / browse / child. By contrast, COPPA de- 
fines “child” as a subset of “minor.” COPPA 2.0 bills would apply to older minors not currently 
subject to COPPA, generally referred to as “adolescents.” 

21 16 C.F.R. §312.2 (definition of “website or online service directed to children”); see infra at 
22-24 (discussing the FTC’s criteria for deciding what constitutes a site “directed to” children). 

22 See 16 C.F.R. §312.3; see also 16 C.F.R. §312.2 (definition of “website or online service di- 
rected to children”). 

23 We use the term “Pi-collecting sites” to refer to both sites and services only for lack of a 
clearer catch-all. 

24 As the FTC has explained: 

COPPA applies to personal information collected online by websites and online services lo- 
cated on the Internet. The Rule defines “Internet” to mean the myriad of computer and tele- 
communications facilities that make up the world-wide networks that employ the Transmission 
Control Protocol/Internet Protocol (TCP/IP), or any predecessor or successor protocols used to 
communicate information of all kinds by wire, radio, or other methods of transmission. See 16 
C.F.R. §312.2 (definition of “Internet”). The Rule’s Statement of Basis and Purpose makes clear 
that the term Internet is intended to apply to broadband networks, as well as to intranets main- 
tained by online services that either are accessible via the Internet, or that have gateways to 
the Internet. 

Federal Trade Commission, Frequently Asked Questions about the Children’s Online Privacy 
Protection Rule [hereinafter COPPA FAQ], Question 6 (“What types of online transmissions does 
COPPA apply to?”), www.ftc.gov/privacy/coppafaqs.shtm. 

25 Operators of Pi-collecting sites must: 


Continued 
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A. The Difficulties in Obtaining “Verifiable Parental Consent” 

In drafting the regulations that implemented COPPA (the “COPPA Rule” ), 26 the 
Federal Trade Commission (FTC) in 1999 adopted a “sliding scale” approach to ob- 
taining parental consent. 27 This approach allows operators of Pi-collecting sites to 
use a mix of methods to comply with the law, including print-and-fax forms, follow- 
up phone calls and e-mails, credit card authorizations and using encryption certifi- 
cates. 28 The FTC has also authorized four “safe harbor” programs operated by pri- 
vate companies that help website operators comply with COPPA. 29 

In a February 2007 report to Congress about the status of the law and its enforce- 
ment, the FTC said that no changes to COPPA were then necessary because the 
law bad “been effective in helping to protect the privacy and safety of young chil- 
dren online.” 30 In discussing the effectiveness of the parental consent verification 
methods authorized in the FTC’s sliding scale approach, however, the agency ac- 
knowledged that “none of these mechanisms is foolproof.” 31 The FTC attempts to 
distinguish these parental consent verification methods from other kinds of age 
verification tools in noting that “age verification technologies have not kept pace 
with other developments, and are not currently available as a substitute for other 
screening mechanisms.” 32 This makes it clear that the FTC does not regard the 
methods the agency has prescribed for obtaining parental consent under COPPA as 
equivalent to strict age verification. 

Although credit cards may seem the most robust tool for verifying parental con- 
sent (essentially, age verifying the parent), Federal courts have found, in rejecting 
the constitutionality of COPA, that, “payment cards cannot be used to verify age be- 
cause minors under 17 have access to credit cards, debit cards, and reloadable pre- 
paid cards” and, although “payment card issuers usually will not issue credit and 
debit cards directly to minors without their parent’s consent because of the financial 
risks associated with minors . . . there are many other ways in which a minor may 
obtain and use payment cards.” 33 

B. “Collection”: Wheti Parental Consent is Required 

COPPA requires that operators obtain verifiable parental consent “before any col- 
lection, use, and/or disclosure of personal information from children” — as well as for 
“any material change in the collection, use, and/or disclosure practices to which the 
parent has previously consented,” 34 subject to certain narrow exceptions. 35 Under- 
standing how the COPPA Rule currently works and the pitfalls of COPPA expansion 


Provide notice on the website or online service of what information it collects from children, 
how it uses such information, and its disclosure practices for such information; . . . (c) Provide 
a reasonable means for a parent to review the personal information collected from a child and 
to refuse to permit its further use or maintenance; (d) Not condition a child’s participation in 
a game, the offering of a prize, or another activity on the child disclosing more personal informa- 
tion than is reasonably necessary to participate in such activity; and (e) Establish and maintain 
reasonable procedures to protect the confidentiality, security, and integrity of personal informa- 
tion collected from children. 

16 C.F.R. § 312.3 (internal cross-references omitted). 

26 16 C.F.R. Part 312. We use “COPPA Rule” when referring specifically to the FTC’s imple- 
menting regulations, but use “COPPA” both to refer to the statute itself and to the scheme gen- 
erally where appropriate. 

27 See Federal Trade Commission, How to Comply with The Children’s Online Privacy Protec- 
tion Rule, Nov. 1999, www.ftc.govlbcpledulpubslbusinesslidtheftlbus45.shtm. 

28 16 C.F.R. § 312.5(b)(2). See generally Children’s Online Privacy Protection Rule, 64 Fed. Reg. 
59,888 (Nov. 3, 1999), available at www.ftc.gov /os/ 1999 / 10 / 64fr59888.pdf [hereinafter 1999 
COPPA Order]; see also COPPA FAQ supra note 24, Question 32 (“How do I get parental con- 
sent?”). 

29 The four safe harbor programs are administered by the Children’s Advertising Review Unit 

of the Council of Better Business Bureaus (CARU); the Entertainment Software Rating Board 
(ESRB); TRUSTe; and Privo. See Federal Trade Commission, Safe Harbor Program, 
www.ftc.gov / privacy / privacyinitiatives / childrens shp.html. 

30 Federal Trade Commission, Implementing the Children’s Online Privacy Protection Act: A 

Report to Congress at 1, Feb. 2007, www.ftc.gov/reports/coppal07COPPA Report to 

Congress.pdf [hereinafter 2007 COPPA Implementation Report], 

31 Id. at 13. 

32 Id. at 12. 

33 Gonzales, 478 F. Supp. 2d at 801. COPA would have prohibited the online dissemination 
of material deemed harmful to minors under 17 for commercial purposes, 47 U.S.C. § 231(a)(1), 
subject to a safe harbor for sites that made a “good faith” effort to restrict access by minors: 
“(A) by requiring use of a credit card, debit account, adult access code, or adult personal identi- 
fication number; (B) by accepting a digital certificate that verifies age; or (C) by any other rea- 
sonable measures that are feasible under available technology,” 47 U.S.C. § 231(c)(1). 

34 16 C.F.R. § 312.5(a). 

35 16 C.F.R. § 312.5(c). 
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requires examining the three-pronged definition of “collection” created by the FTC, 
which COPPA itself left undefined. 36 

1. Requests from Sites 

Most obviously, the COPPA Rule considers “collection” to occur each time a PI- 
collecting site requests “that children submit personal information online.” 37 This 
requirement generally minimizes the amount of data collected from children and en- 
sures that parents control the collection of information from their children. 

2. Enabling Sharing of Personal Information 

Less intuitively, the COPPA Rule considers “collection” to occur when a PI-col- 
lecting site merely “enabl[es] children to make personal information publicly avail- 
able . . . except where the operator deletes all individually identifiable information 
from postings by children before they are made public, and also deletes such infor- 
mation from the operator’s records.” 38 

Unlike the first prong of “collection,” consent is not required each time a commu- 
nications tool is used to “make personal information publicly available,” but merely 
for the child to gain access to the tool (e.g., upon creation of a user account). Thus, 
the FTC intends to make parents gatekeepers over which sites their children join 
or participate in, rather than to give parents a veto right over every instance in 
which a child wants to share personal information (e.g., by posting it to their profile 
or “wall” on a social networking site). Given the degree of interactivity on social net- 
working sites, it is difficult to imagine how so granular a veto requirement could 
be feasibly implemented if COPPA were expanded. 

What it means to make information “publicly available” is unclear. COPPA clearly 
requires consent before granting a child access to a site that would allow the child 
to “broadcast” personal information, such as by posting their name, photo, contact 
information, etc. such that the “public” can access that information, whether that 
means posting information to a social networking profile, on a website, or in a “pub- 
lic” chat room or message board (the latter two being the specific examples cited 
in COPPA and the COPPA Rule). 39 But does COPPA apply to communications that 
are not intended to be public? Would COPPA apply to a site that only allowed users 
to send “private” messages to each other? In short, how public is “public” enough 
that giving a child access to the underlying functionality would constitute collection? 
The FTC has never clearly answered these questions, but it has implied that it 
takes the “maximalist” view of what counts as collection: Allowing children to share 
personal information with anyone, even in one-to-one communications, constitutes 
“collection” subject to COPPA’s parental consent requirement. 40 By contrast, the 
“minimalist” view would define “collection” in terms of the capability to “publish” 
or “broadcast” personal information such that it becomes “available” to anyone with 
access to the Pi-collecting site. Which view a court would accept, if presented with 


36 The FTC has provided three definitions of “collection”: 

the gathering of any personal information from a child by any means, including but not lim- 
ited to: (a) Requesting that children submit personal information online; (b) Enabling children 
to make personal information publicly available through a chat room, message board, or other 
means, except where the operator deletes all individually identifiable information from postings 
by children before they are made public, and also deletes such information from the operator’s 
records; or (c) The passive tracking or use of any identifying code linked to an individual, such 
as a cookie. 

16 C.F.R. § 312.2. See also infra at Section II.B. 

37 16 C.F.R. §312.2 (definition of “collection”). 

38 /d. 

39 15 U.S.C. §6501(4XB)(iv-v) (definition of “disclosure”); 16 C.F.R. §312.2 (definition of “col- 
lection”). 

40 In December 2007, the FTC added a question it its FAQ reflecting the agency’s view that 
COPPA would require parental consent before allowing a child to send electronic greeting cards 
or forward items of interest to their friends. COPPA FAQ supra note 24, Question 44 (“My child- 
directed website wants to offer electronic post cards and the ability for children to forward items 
of interest on my site to their friends. Can I take advantage of one of the e-mail exceptions to 
parental consent?”). The FTC requires parental consent if users can "freely type messages in 
either the subject line of the e-card or in any text fields” — presumably, because this might lead 
to the sharing of personal information with the card’s recipient. See Jim Dunstan, E-cards and 
“Forward-to-a-Friend” Promotions: Not Kid Friendly Anymore, www.gsblaw.com V practice / 
notableevents.asp?StoryID=1137185152008&groupID=21; see also Jim Dunstan, FTC Issues 
Final Rules in CAN-SPAM Proceeding: Forward-To-A-Friend Promotion Mystery Solved, 
www.gsblaw.com / practice / notableevents.asp?StoryID=l 7866132008&groupID=21. 
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a challenge to COPPA, is beyond the scope of this paper, but the ambiguity is worth 
noting. 41 

However broad the definition of “publicly available,” the FTC’s definition of “col- 
lection” to include the enabling of communication by children that might result in 
the any of personal information was itself controversial when the FTC first wrote 
the COPPA rules. The FTC (again) took a maximalist view of “collection,” 42 over- 
riding the objections of free speech advocates who argued that Congress intended 
“to place duties on those who collect information from children” (in the normal sense 
of “collection” contained in the first prong of the definition) rather than “to regulate 
children’s behavior” or “limit children’s ability to speak.” 43 These advocates pro- 
posed a minimalist definition of “collection” as “gathering, by an operator, of per- 
sonal information,” such that merely providing functionality like chat rooms and 
message boards would not constitute collection unless the operator actually gleaned 
personal information from such fora. 44 

3. Online Tracking & Cookies 

Finally, COPPA would consider collection to occur through the use of persistent 
identifiers such as cookies 45 if associated with individually identifiable information 
or “a combination of a last name or photograph of the individual with other informa- 
tion such that the combination permits physical or online contacting.” 46 

C. COPPA’s Place in an Evolving Landscape 

In the decade since Congress enacted COPPA, the kinds of information-sharing 
functionality governed by the “publicly available” prong of collection have exploded 
in popularity. New interactive communications tools and methods, now generally re- 
ferred to as “social networking” capabilities, are a key hallmark of the “Web 2.0” 
era. 47 Of course, they had their precursors even in 1998, but the examples of such 
tools included in COPPA and the initial COPPA rule reveal just how much the web 
has evolved: “Chat rooms” and “message boards” certainly still exist but they have 
largely morphed into today’s social networking sites (e.g., Facebook, Myspace), 
which would have been unrecognizable in 1998, while services like blogging and 
micro-blogging (e.g., Twitter) would have been inconceivable. Today, more users feel 
comfortable making personal information more “publicly available” than ever before, 
broadcasting their every thought and action, and even their exact physical loca- 
tion, 48 for all the world to see. 

The growing ubiquity of “Web 2.0” tools has two implications. First, the sites cur- 
rently covered by COPPA are growing ever more limited in their functionality rel- 
ative to the rest of the Internet, as discussed be low. 49 For example, child-oriented 
sites must obtain verifiable parental consent before allowing children to send e- 
cards or use “Forward-to-a-Friend” functionality if the sites “permit the sender to 
enter her full name, her e-mail address, or the recipient’s full name” or “provide 
users with the ability to freely type messages in either the subject line of the e-card 
or in any text fields.” 50 Second, even under the minimalist view of “publicly avail- 
able,” expanding COPPA’s age scope would affect far more websites today than it 
would have 11 years ago, because the functionality that constitutes “collection” 
(under the second prong of that term’s definition) is now pervasive. 


41 The maximalist approach essentially reads the term “publicly available” out of the statute 
by construing collection to mean “available to anyone.” Such a construction might, for example, 
violate the cannon of statutory interpretation against surplusage: “[T]he presence of statutory 
language ‘cannot be regarded as mere surplusage; it means something.’” Chickasaw Nation v. 
United States, 534 U.S. 84, 97 (2001) (quoting Potter v. United States, 155 U.S. 438, 446 (1894)). 

42 1999 COPPA Order, supra note 28, at 59,889-890. 

43 Supplemental Comments of The Center for Democracy and Technology, The American Civil 
Liberties Union, and The American Library Association, filed in Rulemaking to Implement the 
Children’s Online Privacy Protection Act of 1998, Aug. 25, 1999, at §I.B www.ftc.gov / privacy / 
comments / supplementalcdtacluala.htm. 

44 Id. (emphasis original, indicating proposed addition to the FTC’s rule as originally pro- 
posed). 

45 16 C.F.R. §312.2 (definition of “collects or collection”). 

46 16 C.F.R. §312.2 (definition of “personal information”). 

47 Tim O’Reilly, What Is Web 2.0?: Design Patterns and Business Models for the Next Genera- 
tion of Software, Sept. 30, 2005, www.oreillynet.com/lptlal6228. 

48 See, e.g., Google Latitude, www.google.com/latitude/intro.html; loopt, www.loopt.com; 
Pelago, http:/ / pelago.com. 

49 See infra at Section III. A. 

"Absent such sharing, the FTC allows child-oriented sites to use COPPA’s exception for one- 
time communications, found at 16 C.F.R. § 312.5(c). See supra note 40. 
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III. Does COPPA Really Work? 

Before addressing the many challenges associated with COPPA 2.0 proposals, one 
must ask the critical — but ignored — threshold question: Is “COPPA 1.0” really work- 
ing? To answer this question, one must first decide what COPPA 1.0 is supposed 
to accomplish. The original goals of COPPA, as expressed by its Congressional spon- 
sors, were to: 

(1) to enhance parental involvement in a child’s online activities in order to pro- 
tect the privacy of children in the online environment; (2) to enhance parental 
involvement to help protect the safety of children in online fora such as 
chatrooms, home pages, and pen-pal services in which children may make pub- 
lic postings of identifying information; (3) to maintain the security of personally 
identifiable information of children collected online; and (4) to protect children’s 
privacy by limiting the collection of personal information from children without 
parental consent. 51 

Thus, as its name implies, COPPA is first and foremost about protecting the pri- 
vacy of children. COPPA’s primary means for achieving this goal is enhancing pa- 
rental involvement or, as the FTC has put it, “providfing] parents with a set of effec- 
tive tools . . . for becoming involved in and overseeing their children’s interactions 
online.” 52 However admirable, “protect[ing] the safety of children” is merely an indi- 
rect goal of COPPA — something to be achieved through the means of enhancing pa- 
rental involvement (COPPA’s direct goal). The FTC has attempted to blur this dis- 
tinction, elevating child protection to a direct goal of COPPA. 53 Indeed, this was the 
primary reason the FTC adopted the maximalist definition of “collection” to include 
enabling communication (rather than direct gathering of personal information by op- 
erators), over-ruling free speech concerns. 54 

The FTC claims COPPA “has provided a workable system to help protect the on- 
line safety and privacy of the Internet’s youngest visitors.” 55 Indeed, many of those 
advocating expansion of COPPA do so on the grounds that COPPA makes children 
safer online from sexual predators. What these advocates fail to acknowledge is 
that, to the extent COPPA has enhanced child safety — indeed, to the extent that 
COPPA can be effectively administered at all — it is because of the unique cir- 
cumstances of the under-13 age bracket and the Pi-collecting sites that have evolved 
to serve that community. In particular: 

1. The functionality of child-oriented sites is usually tightly limited: They are 
closed, walled gardens; 

2. Many smaller websites catering to children charge a fee for admission — even 
as fee-based models have withered away on the rest of the Internet; and 

3. There are relatively few sites that cater exclusively to the under-13 crowd, 
which may be an unintended consequence of COPPA itself. 

Each of these factors is discussed below, as relates to COPPA’s perceived goals. 
A. Child-Oriented, Sites Limit Functionality 

Child-oriented sites typically have very limited functionality: In essence, their op- 
erators intentionally “cripple” the sort of functionality found in most Pi-collecting 
sites (especially social networking sites) geared toward older users. That fact alone 
makes COPPA-covered sites far less likely to be subject to fraudulent entry or dan- 
gerous interactions: Why would an adolescent or an adult predator ever want to gain 
access to a site that offers little more than drop-down menus and a few buttons to 
click on when interacting with others? 


51 144 Cong. Rec. S11657 (daily ed. Oct. 7, 1998) (statement of Rep. Bryan). 

52 2007 COPPA Implementation Report, supra note 30, at 28. 

53 The FTC has carefully — or perhaps simply carelessly — edited Congress’s original statement 
of purpose: Where Congress had originally declared that COPPA was intended “to enhance pa- 
rental involvement to help protect the safety of children [online],” 144 Cong. Rec. S11657 (em- 
phasis added), the FTC has declared that COPPA was intended “to protect the safety of children 
[online].” 2007 COPPA Implementation Report, supra note 30, at 3. 

54 The FTC based its adoption of the maximalist view of “collection” by noting that: 
children’s use of chat rooms and bulletin boards that are accessible to all online users present 

the most serious safety risks, because it enables them to communicate freely with strangers. 
Indeed, an investigation conducted by the FBI and the Justice Department revealed that these 
services are quickly becoming the most common resources used by predators for identifying and 
contacting children. 

1999 COPPA Order, supra note 28, at 59,890 (internal citations omitted). See also supra at 
11 and note 43. 

55 2007 COPPA Implementation Report, supra note 30, at 28. 
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The primary reason that children are likely safer in those environments probably 
has less to do with COPPA’s parental consent requirements and much more to do 
with the fact that most of the Pi-collecting sites covered by COPPA are tightly con- 
trolled and highly moderated walled gardens with very limited functionality — a sort 
of “Junior Internet.” 

B. Child-Oriented. Sites Charge Fees 

While most Internet content and services are now “free” (i.e., advertising-sup- 
ported ), 56 many child-oriented Pi-collecting sites charge admission fees. There are 
several reasons they do so: 

• “[Requiring a parent to use a credit card in connection with a transaction” is 
among the methods for obtaining verifiable parental consent in the FTC’s slid- 
ing scale. 57 The FTC requires that an operator charge some fee so that the cred- 
it card will be verified by its issuer and “because, through receipt of a monthly 
statement, the parent is given additional notice that the transaction occurred 
and has an opportunity to investigate any suspicious activity and revoke con- 
sent.” 58 

• Commercial child-oriented sites must somehow recoup the costs of obtaining 
verifiable parental consent — estimated in 2005 at more than $45 per child. 59 
Because COPPA limits operators’ ability to effectively target advertising to chil- 
dren, thereby reducing the value of advertising inventory on Pi-collecting sites, 
they usually must rely on direct fees. 

• Many child-oriented sites rely heavily on constant human moderation and over- 
sight, which necessitates a method of funding those workers. 

• It is easier for child-oriented sites to continue charging small fees once they 
have a credit card on file (something most sites never accomplish) and because 
there is relatively less competition in the child-oriented marketplace than in the 
Internet generally. 

Importantly, the more a site charges for access, the more likely it is that the par- 
ent or guardian pays attention to what their child is doing on that site. The hassle 
for parents of having to pay a fee gets parents thinking, and talking to their kids, 
about those sites, argues Denise Tayloe of Privo, one of the four FTC-approved pro- 
viders of COPPA safe harbor age verification services. 60 

However, Tayloe has noted that one of the problems associated with the current 
COPPA regime is that “Children quickly learned to lie about their age in order to 
gain access to the interactive features on their favorite sites. As a result,” she notes, 
“data bases have become tainted with inaccurate information and chaos seems to 
be king where COPPA is concerned.” 61 The FTC, well aware that blocking access 
to children under 13 could simply encourage them to lie about their age, requires 
operators to “design [their] age collection input screens in a manner that does not 
encourage children to provide a false age in order to gain access to [their] site.” 62 
In particular, the FTC recommends “using a temporary or a permanent cookie to 
prevent children from back-buttoning to enter a different age.” 63 But if children can 
learn to lie about their age, they can probably learn to delete cookies, too — since 
cookie deletion is a privacy feature now common in every browser. 64 

Despite these problems, Tayloe falls back on the original justification of COPPA: 
increasing parental involvement. Even though “there is no perfect solution” and it 


56 See, e.g., Chris Anderson, Free ! Why $0.00 Is the Future of Business, Wired, Feb. 25, 2008, 
www.wired.com / techbiz / it / magazine / 16-03 / ff free. The most notable exception to this rule is 
Massively Multiplayer Online games such as World of Warcraft, which are also potentially sub- 
ject to COPPA. 

57 16 C.F.R. § 312.5(b)(2). 

58 See COPPA FAQ, supra note 24, Question 33 (“I would like to get consent by collecting a 
credit card number from the parent, but I don’t want to engage in a transaction. Is this ok?”). 

59 See Comments of Parry Aftab, Request for Public Comment on the Implementation of 
COPPA and COPPA Rule’s Sliding Scale Mechanism for Obtaining Verifiable Parental Consent 
Before Collecting Personal Information from Children at 2, June 27, 2005, www.ftc.gov / os / com- 
ments / COPPArulereview / 516296-00021.pdf [hereinafter Aftab Comments ]. 

60 Denise Tayloe, It’s Time to Comply with COPPA, The Privacy Advisor, Vol. 6, No. 10, Oct. 
2006, at 5. 

el Id. 

62 See COPPA FAQ, supra note 58, Question 39 (“Can I block children under 13 from my gen- 
eral audience website?”). 

63 Id. 

64 Adam Thierer, Berin Szoka & Adam Marcus, The Progress & Freedom Foundation, Privacy 

Solutions, PFF Blog, Ongoing Series, http:/ 1 blog.pff.org / archives ! ongoing series / privacy 

solutions. 
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is not possible to completely “stop a child from lying and putting themselves at 
risk,” Tayloe believes that COPPA “provides a platform to educate parents and kids 
about privacy.” 65 Providing a platform to educate parents and kids about online pri- 
vacy or safety is certainly important, but there are other ways to do this besides 
imposing strict age verification mandates. Educational initiatives and public service 
announcements, for example, could also encourage greater parent-child interaction. 
Indeed, the courts have concluded that the First Amendment requires the govern- 
ment to utilize such educational initiatives as “less restrictive” alternatives to age 
verification technologies in other contexts. 66 

While we don’t really have any idea what level of parent-child interaction COPPA 
incentivizes, or how many children (or adults) are able to gain access to Pi-collecting 
sites under false pretenses, the key operational assumption on which COPPA rests 
is that by creating an added economic hurdle or barrier to entry (in the form of 
entry fees or the hassle of filling out paperwork or forms), COPPA gets some — 
maybe even most — parents to put more thought into what their kids are doing on- 
line, and that in turn somehow improves online child safety. 

However useful COPPA might be in enhancing parental involvement, it does not 
necessarily mean that children are operating in perfectly “secure” or “verified” envi- 
ronments. COPPA wasn’t primarily put on the books to prevent “bad guys” from 
interacting with children online; it was about minimizing the collection of children’s 
personal information and giving parents control over collection of information from 
their children. 67 Thus, COPPA does not require excluding older users from child- 
oriented sites, some websites indeed may try to do so, building on COPPA’s required 
age verification system, because of market demand from parents to exclude sexual 
predators. Of course, age verification is hardly fool-proof for either kids or adults. 
So, to the extent some “bad guys” are getting on those sites under false pretenses, 
both children and parents may be lulled into to a false sense of security after they 
are told the site is COPPA- verified — whether or not the site actually attempts to 
exclude older users and regardless of how effective the site may be in doing so. This 
may actually increase the danger of predation to children. 68 

C. Does COPPA Encourage Consolidation or Limit Competition ? 

As noted above, there are significant costs associated with the verifiable parental 
consent methods that Pi-collecting sites must implement to comply with COPPA. If 
we are to fully understand the experience of COPPA as a regulatory model, we must 
consider the extent to which COPPA may have had the unintended consequence of 
limiting choice and competition by driving increased consolidation in the market- 
place for child-oriented sites and services online — a question the FTC should con- 
sider answering. As early as 2001, even some Congressmen recognized this “unin- 
tended consequence” of COPPA in Congressional hearings on privacy. 69 


65 E-mail from Denise Tayloe to Adam Thierer (Mar. 15, 2007) (copy on file with author). 

66 See infra at VI.A.3. 

67 See supra at 16. 

68 Internet security expert John Cardillo argues that even COPPA-compliant sites are vulner- 
able: 

During an analysis of the security processes of certain sites we tested Imbee’s. Our security 
team was able to create several fake children. More troubling was the inconsistency of the infor- 
mation used to do so. We used a fake name for the parent, a different fake name created for 
the Yahoo! e-mail account used at registration, and my credit card info (because the name on 
the CC is irrelevant). Fictional child, and three fake identifiers on supposedly the same adult. 
Not one red flag was raised, and we were allowed onto the site without a problem. Our team 
was able to do this multiple times. Had we been a real bad guy, we could have, at any time, 
chatted with other kids on the site as a child. One of several different children actually. Not 
only isn’t it a security solution, it’s downright dangerous. 

E-mail from John J. Cardillo to Adam Thierer (March 11, 2007) (copy on file with author). 
Cardillo’s findings thus make it clear how real predators intent on doing harm to children could 
exploit age verification processes designed to exclude adults from a supposedly “teens-only” site 
(just as predators already do with sites supposedly limited to kids under 13). Indeed, because 
many predators have children of their own, they might use this approach to obtain an ID for 
their own kids and then go online under their child’s name to prey on other children. The fiction 
that all users of a site are "verified” creates a false sense of security — a serious problem for child 
safety. As Cardillo has noted elsewhere, predators who create a “pedophile passport” could oper- 
ate freely in supposedly “safe and secure” environments. See Adam Thierer, The Progress & 
Freedom Foundation, Age Verification for Social Networking Sites: Is It Possible ? Is It Desir- 
able 1 '. I, Progress on Point 14.8, May 2007, at 6, www.pff.org/issues-pubs/popslpopl4.8ag 
euerificationtranscript.pdf 

69 Rep. Billy Tauzin (R-LA) noted that COPPA “has now forced companies to discontinue a 
number of products targeted toward children” and asked “If we end up forcing private compa- 
nies and nonprofits to eliminate beneficial products such as crime prevention material, have we 

Continued 
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Of course, it could be the case that there are other reasons that there are rel- 
atively few sites catering exclusively to children. Nonetheless, as discussed below, 
it’s worth considering how expanding COPPA might lead to more consolidation in 
the marketplace or how it discourages greater entry by smaller “mom-and-pop” sites 
that could cater to children. As noted by Parry Aftab, Executive Director of the chil- 
dren’s advocacy group Wired Safety, “COPPA wasn’t responsible for the demise of 
these sites, but when combined with the other factors [it] tipped the balance.” 70 She 
concludes, appropriately: 

It is crucial that at this tentative stage for the kids Internet industry we don’t 
do anything to make its survival more difficult. We should be looking at easy 
to encourage safer communities for preteens and innovations to help create fun, 
entertaining and educational content for kids online. 71 

IV. What if COPPA Were Expanded to Cover Adolescents? 

However effective COPPA might be in fulfilling its purposes, and whatever its un- 
intended consequences, the COPPA Rule’s requirements are relatively easy for the 
private sector to implement and for the government to enforce because, as men- 
tioned, they apply only to the collection of information about children under 13 by 
commercial operators only when (i) the operator’s Pi-collecting Site or service is “di- 
rected to children” or (ii) the operator has actual knowledge that they are collecting 
personal information from a child. But how well would the COPPA approach “scale 
up” to the 13-17 age bracket? 

The key practical difficulty in implementing a COPPA 2.0 system for adolescents 
is in the anonymity inherent in the technical architecture of the Internet. To quote 
a memorable cartoon from The New Yorker of all time: “On the Internet, nobody 
knows you’re a dog.” 72 Because website operators generally do not know who is ac- 
cessing their site, requiring any special treatment of minors (e.g., parental consent 
prior to the collection of personal information, access to the child’s user profile) is 
tantamount to requiring age-verification of all users. 73 

Because “child-oriented” websites are generally easy to define and are very rarely 
used by adults, COPPA 1.0s age verification mandate has not significantly impacted 
the free speech rights of adults. But it is far more difficult to define a class of “ado- 
lescent-oriented” websites (as proposed in New Jersey) that are not also used by sig- 
nificant numbers of adults. Indeed, the Illinois bill does not even attempt to do so, 
defining its scope not in COPPA’s “directed at” terms but purely in terms of site 
functionality. 74 In this sense, the Illinois bill is more restrictive than the New Jer- 
sey bill, since it would apply to sites with a certain functionality regardless of to 
whom they are “directed at.” On the other hand, the New Jersey proposal is far 
more sweeping, since it applies to any site that collects user information if the site 
is “directed at” adolescents. 75 Whichever bill might ultimately affect more websites, 
the practical result of both COPPA 2.0 proposals is the same: They would, without 


done a good thing? If teen-friendly sites, those that totally respect the privacy of the users stop 
offering e-mail services to children, is that a good thing? An Examination of Existing Federal 
Statutes Addressing Information Privacy: Hearing of the House Committee On Energy and 
Commerce, 107th Cong. 6 (April 3, 2001) (statement of Rep. Tauzin.), available at http :/ / repub- 
licans. energycommerce.house.gov / 1 07 /action / 1 07-22.pdf. 

70 Aftab Comments, supra note 59, at 3. 

71 Id. 

72 Peter Steiner, On the Internet, Nobody Knows You’re a Dog, The New Yorker, July 5, 1993 
at 61, available at www.unc.edu/depts/jomc/academics/dri/idog.html (cartoon of a dog, sitting 
at a computer terminal, talking to another dog). 

73 Of course, the COPPA’s second prong of age-verification requirement applies only when the 
website operator has “actual knowledge” that the user is a minor. See supra at 7 & note 22. 

74 The Illinois Bill defines a “social networking site” as: 

an Internet website containing profile web pages of the members of the website that include 
the names or nicknames of such members, photographs placed on the profile web pages by such 
member, or any other personal or personally identifying information about such members and 
links to other profile web pages on social networking websites of friends or associates of such 
members that can be accessed by other members or visitors to the website. A social networking 
website provides members of or visitors to such website the ability to leave messages or com- 
ments on the profile web page that are visible to all or some visitors to the profile web page 
and may also include a form of electronic mail for members of the social networking website. 

SNWARA, supra note 11, §5. This definition seems almost tailor-made for MySpace and 
Facebook: The second sentence of the definition would exclude sites like Linkedln, which in- 
cludes profiles but does not allow users to post public comments on other users’ profiles. While 
this focus on specific site functionality seems to differ from COPPA’s approach, in fact it does 
little more than apply COPPA’s second definition of “collection” as "Enabling children to make 
personal information publicly available.” See 16 C.F.R. §312.2 (definition of “collection”); see also 
supra at 8. 

75 See supra note 13. 
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explicitly saying so, require age verification of a large numbers of adults. This raises 
profound First Amendment concerns — particularly about the right of Americans to 
speak and receive information anonymously online. 76 

V. The Differences Between Children (0-12) & Adolescents (13-17) 

Before examining these First Amendment concerns (which are more directly ap- 
parent in the case of the Illinois proposal), one must ask how they arise in the case 
of the more complicated New Jersey proposal, which applies to Pi-collecting sites 
“directed at” adolescents. 77 This examination reveals the fundamental flaw in any 
attempt to extend COPPA to cover adolescents: COPPA 1.0 works only because of 
the unique characteristics of the under-13 age bracket. 

A. Subjective Assessments about Intended Audiences Are Significantly Easier for 
Children than for Adolescents 

In determining whether a Pi-collecting Site or service is “directed at children,” the 
FTC considers the site or service’s “subject matter, visual or audio content, age of 
models, language or other characteristics of the website or online service, as well 
as whether advertising promoting or appearing on the website or online service is 
directed to children . . . and whether a site uses animated characters.” 78 The fol- 
lowing excerpts from FTC complaints illustrate how the agency has applied these 
criteria: 

The . . . subject matter [of www.lilromeo.com] is Lil’ Romeo, a twelve-year-old 
recording artist who “enjoys ‘just being a regular kid.’” The website features 
content directed to children such as an animated game in which the player 
helps Lil’ Romeo save an elementary school from aliens by answering simple 
math and history questions. The website also features music and lyrics from Lil’ 
Romeo’s album “Game Time,” which is “about having fun, and also about, you 
know, kids[’] things . . .” 79 

And: 

Defendant operates the www.etch-a-sketch.com website, which provides informa- 
tion about its toys, including the “Etch A Sketch” drawing toy. The subject mat- 
ter, visual content, and language of this website are directed to children under 
the age of 13. For example, the site features a cartoon character named 
“Etchy” — an Etch A Sketch sporting sunglasses, purple hair and legs. Etchy in- 
vites visitors to play “cool games,” such as drawing with an online Etch A 
Sketch, finding hidden numbers, letters and shapes, and coloring pictures of 
Etchy and friends. The site also contains an “interactive story” titled, “Etchy 
Goes to a Birthday Party.” 80 

The FTC settled both cases with consent decrees — like, apparently, all the FTC’s 
COPPA enforcement actions. 81 These examples demonstrate that subjective stand- 
ards can sometimes work reasonably well in certain contexts. As Justice Potter 
Stewart famously said of obscenity, “I know it when I see it.” 82 The same could 
probably be said, in many cases, about what constitutes child-oriented content; and 
this approach seems to have worked well enough for the FTC’s COPPA enforcement 
efforts. But how well, if at all, would such a standard work in determining the scope 
of COPPA 2.0 proposals (like New Jersey’s) that retain COPPA’s requirement that 
a site be “directed at” a certain audience when that audience is not children (0-12) 
but adolescents (13-17)? 83 

Any regulatory system that, like COPPA, rests on age stratification inevitably re- 
quires the drawing of arbitrary boundaries. But ultimately, some age must be cho- 
sen. Whatever the differences between 12 and 13, the differences between 12 


76 Adam Thierer, The Progress & Freedom Foundation, USA Today, Age Verification, and the 

Death of Online Anonymity, PFF Blog, Jan. 23, 2008, http: / lblog.pff.org / archives 12008 / 01 / 
usa today doesn.html. 

77 Like COPPA, New Jersey’s AOPPA bill also applies to cases of actual knowledge that an 
operator is collecting personal information from an adolescent. See supra note 13. 

78 16 C.F.R. § 312.2 (definition of “website or online service directed to children”). 

79 U.S. v. UMG Recordings, Inc., Civil Action No. CV-04-1050, Complaint at 4—5 (C.D. Ca. 
2004), www.ftc.gov / os / caselist / umgrecordings 104021 7compumgrecording.pdf. 

80 U.S. v. The Ohio Art Company, Complaint, 12 (N.D. Oh. 2002), www.ftc.gov / os / 2002 / 04 / 
ohioartcomplaint.htm . 

8 1 See Federal Trade Commission, Children’s Privacy Enforcement Cases, www.ftc.gov / pri- 
vacy / privacyinitiatives / childrens enf.html (including a consent decree for each case). 

82 Jacobellis v. Ohio, 378 U.S. 184, 197 (1964) (Stewart, J., concurring). 

83 While New Jersey’s proposal retains this approach, hewing closely to COPPA’s current 
structure, see supra note 13 and accompanying text , Illinois’s proposal drops the concept and 
simply applies to all sites with certain social networking functionality, see supra note 11. 
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(COPPA’s ceiling) and 17 (the ceiling established in some COPPA 2.0 measures) are 
significant. Although the original version of the COPPA legislation would have re- 
quired “reasonable efforts to provide the parents with notice and an opportunity to 
prevent or curtail the collection or use of personal information” for kids 13-16, the 
legislation never required verifiable parental consent for minors above 12. 84 The 
FTC explains Congress’s rationale for this distinction as follows: 

Congress and industry self-regulatory bodies have traditionally distinguished 
children aged 12 and under, who are particularly vulnerable to overreaching by 
marketers, from children over the age of 12, for whom strong, but more flexible 
protections may be appropriate. In addition, distinguishing adolescents from 
younger children may be warranted where younger children may not under- 
stand the safety and privacy issues created by the online collection of personal 
information. 85 

Thus, it appears that Congress was simply following a long-standing distinction 
based on the cognitive capabilities of children under 13. But whether anyone real- 
ized it at the time, this distinction has proved essential for the administration of 
COPPA as a statute that defines its scope by the audience to which sites are “di- 
rected.” Whenever the “tipping point” in cognitive capabilities occurs, the age of 13 
roughly corresponds to an important point of departure in psychological growth be- 
tween “childhood” and “adolescence.” 

This moment was best described two thousand years ago by the Apostle Paul of 
Tarsus, when he wrote, “When I was a child, I spake as a child, I understood as 
a child, I thought as a child: but when I became a man, I put away childish 
things .” 86 Paul equated what we think of as “adolescence” — a profoundly modern in- 
vention 87 — with adulthood. Paul had no more conception of “adolescence” than did 
Shakespeare, who — like Congress with COPPA — chose thirteen as the age of Juliet, 
his greatest star-crossed lover. 88 But Paul offered perhaps the best reason why 
COPPA’s scope ends at thirteen: this is the roughly point at which minors begin to 
shun “childish things” — say, losing interest in Club Penguin in favor of more 
“grown-up” sites like MySpace or Facebook. If one has to choose a clear bright line 
rule as to when, on average, that shift occurs, 13 seems to be about as accurate as 
any. (Indeed, modern Jews — like the Jewish Paul before them — continue to recog- 
nize this as the threshold of maturity by generally holding a Bar Mitzvah for boys 
at age 13, and a Bat Mitzvah ceremony for girls at age 12. 89 ) This is less a question 
of how much protection minors of any particular age require, and more a question 
of when their interests change: At about this age, adolescents begin to share inter- 
ests with adults in ways that children 12 and below do not; if left to their own de- 


84 See supra note 14 and associated text. 

85 COPPA FAQ , supra note 58, Question 8 (“Why does COPPA apply only to children under 
13? What about protecting the online privacy of teens?”), www.ftc.gov/privacy/coppafaqs.shtm. 
The FTC also reminds companies: 

websites’ information practices regarding teens and adults are subject to Section 5 of the FTC 
Act, which prohibits unfair or deceptive acts and practices. See Staff Opinion Letter to Center 
for Media Education (July 15, 1997) for guidance on how Section 5 applies to information prac- 
tices involving teens. In addition, recent concern about the risks of child participation on social 
networking websites led the FTC to issue a set of safety tips for social networking. See “Social 
Networking Sites: A Parents’ Guide” (September 2007), available at www.ftc.gov / opa / 2006 / 05 / 

socialnetworking. shtm; see also www.onguardonline.gov / docs / onguardonline socialnetworking. 

pdf. 

86 The First Epistle of Paul the Apostle to the Corinthians 13:11 (King James), available at 
www.hartlehy.com/108/46/13.html (emphasis added). 

87 Sociologist Rowan Wolf explains: 

[F]or much of the history of human society, there has not really been the concept of “child- 
hood” as we know it today. Once a child was able to speak and eat on its own, it was essentially 
considered a miniature adult capable of participating in a limited way in the survival of the 
family. Once “children” hit puberty, they were considered adults, though they might not take 
on adult roles until they formed their own family. There was no concept of adolescence. . . . 
Children went from “miniature adults” expected to act like adults but without the rights of 
adults, to a carefree, dependent period of exploration and learning. When we look at the expecta- 
tions of “teenagers,” we define this as a rebellious period of individuation. We simultaneously 
expect adolescents to act like adults and rebel from them at the same time. This is a period 
where people are sexually mature, but socially and economically dependent. 

Age Stratification, Sept. 2005, www.srwolf.com/wolfsoclarticlearchives/2008llllage strati 

fication.html. 

88 See, e.g., The Invention of Adolescence, Psychology Today, Jan./Feb. 1995, www. psycho 
logytoday.com / articles / pto-19950101-000024.html. 

89 See, e.g., Bar Mitzvah, Bat Mitzvah and Confirmation, Judaism 101, http:/ /www.jew 
faq.org/ harmitz.htm. 
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vices, adolescents would spend far more time on “general audience” 90 websites than 
would children. Thirteen is probably about the point at which this transformation 
begins to accelerate. But regardless of precisely when it happens, it should be ap- 
parent that the sites favored by adolescents 13 and over will be difficult to distin- 
guish as “adolescent-oriented” because they are rarely, if ever, as thoroughly domi- 
nated by adolescents as “child-oriented” sites are by children 12 and under. This 
problem gives rise to the significant constitutional concerns raised by COPPA 2.0 
proposals. 

B. The Difficulties of Empirical Assessments about Intended Audiences 

If the subjective “I know it when I see it standard” is not so easily applied for 
determining what constitutes adolescent-oriented Pi-collecting sites, the alternative 
under the FTC’s COPPA rules is to examine “competent and reliable empirical evi- 
dence.” 91 Could demographic data about a site’s membership provide sufficiently 
clear guidance about the scope of a law that (like New Jersey’s proposal) retains 
COPPA’s current “directed at” approach? 92 

The FTC has never addressed the difficult question of setting a minimum thresh- 
old of child membership/participation in a site above which the site would be consid- 
ered “directed at children:” Not one of the complaints brought by the FTC under 
COPPA cites demographic evidence. Because, as discussed above, child-oriented 
websites tend to exist in a virtually distinct “Junior Internet,” with little overlap 
between adults and children, and because many parents use technological controls 
to keep their children (but not their adolescents) within this Junior Internet, it is 
hardly surprising that the FTC has never answered this question: Subjective cri- 
teria are generally sufficient to identify child-oriented sites, and those sites are like- 
ly to be used overwhelmingly by children or young adolescents with very little adult 
participation. 

But as discussed above, few of the websites frequented by adolescents are domi- 
nated so overwhelmingly by adolescents as children dominate the membership of 
the Junior Internet to which COPPA currently applies. Instead, adolescents partici- 
pate in many of the same Pi-collecting sites used by adults, as demonstrated by the 
following sample of some of the more popular Web 2.0 sites, including demographic 
estimates: 


Exhibit 1: Popular Web 2.0 Sites 93 


Site Name 

Unique U.S. 
Users 

Annual U.S. Page 
Views 

% of Users Under 
Age 18 

myy earbook.com 

2,000,000 

860,000,000 

50.00% 

bebo.com 

2,400,000 

340,000,000 

35.00% 

nickjr.com 

2,400,000 

210,000,000 

31.67% 

myspace.com 

67,000,000 

43,000,000,000 

28.36% 

photobucket.com 

25,000,000 

1,300,000,000 

26.80% 

movie6.net 

1,100,000 

24,000,000 

26.36% 

fanpop.com 

1,100,000 

16,000,000 

21.82% 

xanga.com 

1,600,000 

82,000,000 

20.00% 

tagged.com 

3,500,000 

1,100,000,000 

19.71% 

zango.com 

2,900,000 

21,000,000 

17.93% 

aol.com 

37,000,000 

4,000,000,000 

16.49% 

hi5.com 

2,800,000 

870,000,000 

15.00% 

facebook.com 

74,000,000 

30,000,000,000 

12.16% 

yahoo.com 

140,000,000 

36,000,000,000 

11.43% 

friendster.com 

1,600,000 

490,000,000 

11.25% 

wordpress.com 

23,000,000 

300,000,000 

10.43% 

gametr ailer s .com 

1,200,000 

50,000,000 

10.00% 

flickr.com 

21,000,000 

1,000,000,000 

9.52% 


So would some of these sites be considered “adolescent-oriented” even though 
most of their users are actually adults? Perhaps not in New Jersey (depending on 


90 The term “general audience” is commonly used instead of “adult-oriented” for content that 
is not directed at children. 

91 16 C.F.R. § 312.2 (definition of “website or online service directed to children”). 

92 See supra note 13. 

93 Data obtained from Google Ad Planner on Mar. 1, 2009, https:! / www.google.com/ 
adplanner / planning (by dividing “UV users” for the 0—17 “audience” by “UV users” for the en- 
tire population). 
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the circumstances of any particular site ), 94 but this is essentially what the Illinois 
bill requires: 95 The approximately 88 percent of Facebook’s users 18 and above 
must be age verified for the sake of obtaining parental consent for the 12 percent 
under 18. This example is apt, because 12 percent happens to coincide with the esti- 
mated percentage of American Internet users under 18: 12.6 percent or 28 million 
Americans. 96 

C. Possible Reactions to COPPA 2.0s Uncertain Scope 

Of the top 250 sites ranked by audience reach, only a handful stand out as being 
obviously child-oriented, such as cartoonnetwork.com and nick.com (Nickelodeon). A 
number of leading social networks top the list and many, if not most, of these sites 
require the sharing of some personal information (if only an e-mail address) for full 
functionality. But how would any of these operators — let alone the millions of sites 
in the “Long Tail” of Internet content — determine whether they would be considered 
adolescent-oriented? By the same token, how should a legislator following Illinois’s 
approach (defining the scope of the COPPA 2.0 law in terms of site functionality) 
decide which features should trigger age verification requirements? 

To the extent Pi-collecting Site operators might be unsure whether a COPPA 2.0 
age verification mandate would apply to them, they would likely take one of the fol- 
lowing steps to minimize their potential liability. 

1. Trying to Block All Adolescents 

Of course, since Pi-collecting Site operators do not know which would-be users are 
minors without an age verification system (and perhaps not even then!), the most 
they could do would be to claim that they block access by adolescents. Websites can 
certainly try to block users who initially admit to being under 18 from trying to reg- 
ister again for the site. 97 But this approach is only effective to the extent that ado- 
lescents are naive enough to admit their true age in the first place and not to know 
how to circumvent whatever system the operator has in place for preventing users 
from trying to register for the site after initially being blocked — which should be rel- 
atively simple to do (e.g., by deleting cookies from the site). 

2. Avoiding Actual Knowledge 

Some Pi-collecting Site operators may give up on the “directed at” prong and try 
to avoid gaining “actual knowledge” that a user is under 18 simply by ceasing to 
ask for age information upon the creation of a user account — or perhaps by no 
longer requiring the creation of user accounts altogether. But this is a dangerous 
gamble because, if a site is ultimately found to be “adolescent-oriented,” not asking 
for age upon sign-up might be considered a serious violation in itself. 98 This “Catch- 
22” places site operators in a difficult and legally precarious position — especially sig- 
nificant smaller site operators trying to raise funding. 

Other operators may reduce human moderation of their site in order to avoid situ- 
ations in which an employee might learn that a user is under 18 (e.g., by reading 
their comments or profile). This is precisely the sort of perverse incentive that Con- 
gress attempted to avoid in passing Section 230 of the Communications Decency Act 
of 1996, which fully immunized online intermediaries from liability even if they 
made “good Samaritan” efforts to self-police their sites for objectionable content. 99 
(The FTC has already created this perverse incentive under COPPA, but given the 
demand among parents for heavy moderation on child-oriented sites, COPPA’s per- 
verse incentive may have had little effect. 100 ) Thus, COPPA 2.0 proposals could lead 


94 See supra note 13 and at 17. 

95 See supra note 74. 

96 Data obtained from Google Ad Planner on Mar. 1, 2009, https:! / www.google.com/ 
adplanner / planning (by limiting age to 0—17). 

97 See supra at 29. 

98 For example, the amount of a penalty imposed on an operator deemed to be in violation 
would depend on “Respondent’s good faith” and “The deterrent effect of the penalty action.” 16 
C.F.R. § 1.67(b) & (d). 

99 “No provider or user of an interactive computer service shall be held liable on account of 
. . . any action taken to enable or make available to information content providers or others 
the technical means to restrict access to material . . . material that the provider or user con- 
siders to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objec- 
tionable. . . .” 47 U.S.C. § 230(c)(2). 

100 See COPPA FAQ, supra note 58, Question 41(b) (“What happens if a child visits a chat 
room or creates a blog and announces his or her age?”). The FTC answers: “You may be consid- 
ered to have actual knowledge with respect to that child if someone from your organization sees 
the post, or if someone alerts you to the post (for example, a concerned parent who learns that 
his child is participating on your site). However, if no one in your organization is aware of the 
post, then you may not have the requisite actual knowledge under the Rule.” Id. 
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to less protection for minors, not more, by discouraging site operators from “chaper- 
oning” interaction on their sites. 101 

3. Age-Verifying All Users 

COPPA 2.0s greatest threat is that large numbers of Pi-collecting Site operators 
would be — or would feel — compelled to require age-verification of large numbers of 
adults as users. There is currently no age verification requirement other than 
COPPA, which affects adults only to the extent that parents need to establish their 
parental relationship to their kids. But COPPA affects few other adults because few 
adults want to use child-oriented Pi-collecting sites like Disney’s Club Penguin. 
COPPA 2.0 proposals would either directly require age verification of all adults who 
wanted to use “social networking sites” (as proposed in Illinois) or indirectly require 
much the same thing by mandating age verification for “adolescent-oriented sites” 
(as proposed in New Jersey). Indeed, this may be precisely what some COPPA 2.0 
advocates want, since they may envision it as the only way to make the Internet 
truly “safe” for adolescents. 

But few proponents would make such a goal explicit, for they know that such a 
“scaled-up” COPPA would essentially converge with COPA as a broad age 
verification mandate. As noted below, this highlights the First Amendment implica- 
tions of trying to turn COPPA into something it was not designed to be: not merely 
a tool for enhancing parental involvement and kids’ privacy, but a broad mandate 
for child safety. 

VI. The First Amendment Implications of Broad Age Verification Mandates 

Both COPPA and COPA rest on a stratification of users by age, but the approach 
of the two laws is very different: While COPPA requires age verification if content 
is “directed at” minors under age 13, COPA would have required that all website 
operators restrict access to material deemed “harmful to minors” by minors under 
the age of 17 and therefore requires age verification of all users who attempt to ac- 
cess such content (in order to identify minors). COPPA is focused on certain kinds 
of potentially harmful contacts 102 while COPA is focused on potentially harmful 
content. 103 

But by expanding the age range of COPPA to include adolescents, COPPA 2.0 pro- 
posals essentially converge with COPA, reaching the same practical consequence: 
age verification mandates for large numbers of adults as users (not as parents). 
Only the scope of sites covered by the laws is different: under COPA, sites deemed 
“harmful to minors,” and, under COPPA 2.0, adolescent-oriented or certain social 
networking sites. Thus, to the extent that COPPA 2.0 proposals require age 
verification of adults, they would be subject to constitutional attacks similar to those 
against COPA. But COPPA 2.0 proposals would also burden the rights of adults to 
communicate with adolescents and the free speech rights of adolescents. 

Finally, the fact that COPPA (like COPA) applies only to commercial sites would 
do little to protect it from constitutional attack, because in a world of user-generated 
content, the commercial nature of a site has little to do with the commercial/non- 
commercial nature of the speech carried on it. For example, obviously commercial 
sites like MySpace and Facebook serve as platforms for a wide variety of not-for- 
profit and political communications. 

A. First Amendment Rights of Adults 

After a decade-long court battle over the constitutionality of COPA, the U.S. Su- 
preme Court in January 2009 rejected the government’s latest request to revive the 
law, meaning it is likely dead. 104 Three of the key reasons the courts struck down 
COPA would also apply to COPPA 2.0 proposals. 

1. Anonymous Speech Rights of Adults 

COPA burdened the speech rights of adults to access information subject to age 
verification requirements, both by making speech more difficult and by stigmatizing 
it. In 2003, the Third Circuit noted that age verification requirements “will likely 
deter many adults from accessing restricted content, because many Web users are 


101 See infra at 30. 

102 See supra at 9. 

103 COPA makes it illegal to “knowingly . . . make[ ] any communication for commercial pur- 
poses that is available to any minor and that includes any material that is harmful to minors.” 
47 U.S.C. 231. 

104 See Adam Thierer, The Progress & Freedom Foundation, Closing the Book on COPA, PFF 

Blog, Jan. 21, 2009, httv:l / blog.pff.org / archives / 2009 / 01 / closing the hoo.html. See also Alex 

Harris, Child Online Protection Act Still Unconstitutional, http: / 7 cyherlaw.stanford.edu / packet / 
20081 1 / child-online-protection-act-stillunconstitutional. 
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simply unwilling to provide identification information in order to gain access to con- 
tent, especially where the information they wish to access is sensitive or controver- 
sial.” 105 In 2008, in striking down COPA for the third and final time, the Third Cir- 
cuit approvingly quoted the district court, which had noted that part of the reason 
age verification requirements deterred users from accessing restricted content was 
“because Internet users are concerned about security on the Internet and because 
Internet users are afraid of fraud and identity theft on the Internet.” 106 The district 
court had held that: 

Requiring users to go through an age verification process would lead to a dis- 
tinct loss of personal privacy. Many people wish to browse and access material 
privately and anonymously, especially if it is sexually explicit. Web users are 
especially unlikely to provide a credit card or personal information to gain ac- 
cess to sensitive, personal, controversial, or stigmatized content on the Web. As 
a result of this desire to remain anonymous, many users who are not willing 
to access information non-anonymously will be deterred from accessing the de- 
sired information. 107 

The Supreme Court has recognized the vital importance of anonymous speech in 
the context of traditional publication: 

Anonymous pamphlets, leaflets, brochures and even books have played an im- 
portant role in the progress of mankind. Great works of literature have fre- 
quently been produced by authors writing under assumed names. Despite read- 
ers’ curiosity and the public’s interest in identifying the creator of a work of art, 
an author generally is free to decide whether or not to disclose his or her true 
identity. The decision in favor of anonymity may be motivated by fear of eco- 
nomic or official retaliation, by concern about social ostracism, or merely by a 
desire to preserve as much of one’s privacy as possible. Whatever the motivation 
may be, at least in the field of literary endeavor, the interest in having anony- 
mous works enter the marketplace of ideas unquestionably outweighs any pub- 
lic interest in requiring disclosure as a condition of entry. Accordingly, an au- 
thor’s decision to remain anonymous, like other decisions concerning omissions 
or additions to the content of a publication, is an aspect of the freedom of speech 
protected by the First Amendment. 108 

By imposing broad age verification requirements, COPPA 2.0 would restrict the 
rights of adults to send and receive information anonymously just as COPA did. If 
anything, the speech burdened by COPPA 2.0 deserves more protection, not less, 
than the speech burdened by COPA: Where COPA merely burdened access to con- 
tent deemed “harmful to minors” (viz., pornography), COPPA 2.0 would burden ac- 
cess to material by adults as well as minors not because that material is harmful 
or obscene but merely because it is “directed at” minors! Thus, the content covered 
by COPPA 2.0 proposals could include not merely pornography, but communications 
about political nature, which deserved the highest degree of First Amendment pro- 
tection. 

2. Speech Rights of Site Operators 

The necessary corollary of blocking adults from accessing certain content anony- 
mously — and thereby deterring some users from accessing that content — is that 
COPPA 2.0, like COPA, would necessarily reduce the audience size of Pi-collecting 
sites subject to age verification mandates. Furthermore, such mandates would en- 
courage websites to self-censor themselves to avoid offering content they fear could 
be considered “directed at” adolescents because doing so might subject them to an 
age verification mandate — or to legal liability if they fail to implement age 
verification. The substantial cost of age verification could significantly impact, if not 
make impossible, the business models of many Pi-collecting sites, which generally 
do not charge for content and rely instead on advertising revenues. The Third Cir- 
cuit cited all of these burdens on the free speech rights of website operators in strik- 
ing down COPA. 109 


105 American Civil Liberties Union v. Ashcroft, 322 F.3d 240, 259 (3d Cir. 2003) ( ACLU II). 

106 American Civil Liberties Union v. Ashcroft, 534 F.3d 181, 196 (3d Cir. 2008) ( ACLU III ) 
( Gonzales , 478 F. Supp. 2d 775 at 806). 

107 Gonzales at 805. 

108 McIntyre v. Ohio Elections Comm’n, 514 U.S. 334, 342 (1995) (striking down law that pro- 
hibited distribution of anonymous campaign literature); see also Talley v. California, 362 U.S. 
60 (1960) (striking down a state law that forbade all anonymous leafletting). 

109 See ACLU III, 534 F.3d at 196-97 (citing Gonzales at 804). The Court held that websites 
“face significant costs to implement [COPA’s age verification mandates] and will suffer the loss 
of legitimate visitors once they do so.” Id. at 197. 
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3. Less Restrictive Alternatives to Regulation 

The Third Circuit drew on the Supreme Court’s 2004 decision striking down 
COPA on the grounds that “[bjlocking and filtering software is an alternative that 
is less restrictive than COPA, and, in addition, likely more effective as a means of 
restricting children’s access to materials harmful to them.” 110 Similarly, parental 
control software already empowers parents to restrict their kids’ access to PI-col- 
lecting sites. (It’s particularly easy for parents to restrict access to the leading social 
networking sites that seem to be driving so much of the push for COPPA 2.0, so 
that their kids.) 

Thus, the free speech rights burdened COPPA 2.0 proposals are at least as impor- 
tant as those burdened by COPA, and blocking software already empowers parents 
to restrict their kids’ access to Pi-collecting sites, just as it allows parents to restrict 
access to pornography. Of course, if COPPA 2.0 laws were actually enacted and sub- 
ject to legal challenge, the outcome of the case would depend largely on the level 
of constitutional scrutiny involved. COPPA 2.0 advocates might argue that, what- 
ever the rights at stake, a lower level of constitutional scrutiny should apply be- 
cause COPPA 2.0 does not target a special category of content. If true, this could 
mean that, although age verification mandates to restrict access to “harmful” mate- 
rial are unconstitutional, far more sweeping mandates restricting access to non- 
harmful information could, be constitutional. Such inconsistency is indeed a perverse 
consequence of the fact that our First Amendment jurisprudence focuses not on the 
rights at stake, but on whether a regulation is “content-neutral” in deciding what 
level of scrutiny to apply — which, in turn, often determines the outcome of the 
case. 111 But in this case, COPPA 2.0 proposals likely would be subject to strict scru- 
tiny to the extent that they are, like COPA, focused on a certain category of content: 
that “directed at” adolescents (rather than “harmful to minors”). 

Legislators who attempt to escape strict scrutiny by defining the scope of their 
bill (as in Illinois) not by its targeted audience but by reference to specific functional 
capabilities (in the definition of “social networking site”) 112 will likely find that a 
court will see through such window-dressing: If they recognize that such bills are 
nonetheless aimed at a certain category of adolescent-oriented content, they will 
apply strict scrutiny anyway. But even under intermediate scrutiny, COPPA 2.0 
proposals would be subject to serious attack. 

B. First Amendment Rights of Adolescents 

In addition, in COPPA 2.0 approaches, the government would restrict the ability 
of adolescents to access content, not because it could be harmful to them or because 
it is obscene, but merely because it is “directed to” them. While the First Amend- 
ment rights of minors may not be on par with those of adults, adolescents do have 
the right to access certain types of information and express themselves in certain 
ways. 113 The Supreme Court has held that “constitutional rights do not mature and 
come into being magically only when one attains the state-defined age of major- 
ity.” 114 It remains unclear how an expanded COPPA model might interfere with the 


110 Id. at 198 (quoting ACLU Mukasey, 534 F.3d 181, 198 (2008)). 

1 ' 1 Ashutosh Avinash Bhagwat, The Test that Ate Everything: Intermediate Scrutiny in First 
Amendment Jurisprudence, 2007 U. 111. Law. Rev. 783 (2007), available at http:/ / papers 
.ssrn.com / sol3 / papers. cfm?abstract id=887566. 

112 See supra note 74. 

113 See Theresa Chmara & Daniel Mach, Minors’ Rights to Receive Information Under the First 
Amendment, Memorandum from Jenner & Block to the Freedom To Read Foundation, Feb. 2, 
2004, www.ala.org / ala / ahoutala / offices / oif l ifissues / issuesrelatedlinks / minorsrights.cfm (sum- 
marizing case law regarding minors’ first amendment rights, especially in schools and in the 
context of mandates that public libraries filter Internet content); United States v. American Li- 
brary Ass’n, 123 S. Ct. 2297 (2003), available at laws.findlaw.com /us 1000/ 02-361.html (uphold- 
ing the constitutionality of a filtering software system applicable to minors); see generally. Tin- 
ker v. Des Moines Ind. Comm. School Di.st., 393 U.S. 503 (1969) (upholding students’ rights to 
wear protest armbands and affirming that minors have speech rights) available at 

www.oyez.org / cases / 1960-1969 / 1968 / 1968 21; cf. Morse v. Frederick, 551 U.S. 393 (2007), 

available at www.oyez.org / cases / 2000-2009 / 2006 1 2006 06 278/ (holding that the First 

Amendment rights of students in school and at school-supervised events are not as broad as 
those of adults in other settings). 

114 Planned Parenthood of Cent. Mo. v. Danforth, 428 U.S. 52, 74 (1976) (minors’ right to abor- 
tion). See also Bellotti v. Baird, 443 U.S. 622, 635 n.13 (minors possess close to the “full capacity 
for individual choice which is the presupposition of First Amendment guarantees”); Catherine 
Ross, An Emerging Right for Mature Minors to Receive Information, 2 U. Pa. J. Const. L. 223 
(1999); Lee Tien & Seth Schoen, Reply Comments of the Electronic Frontier Foundation filed 
in Implementation of the Child Safe Viewing Act; Examination of Parental Control Technologies 
for Video or Audio Programming, MB Docket No. 0926, Federal Communications Commission, 

Continued 
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First Amendment rights of adolescents, but it is clear that privacy and speech rights 
would come into conflict under COPPA 2.0, as they do in other contexts. 115 

For example, how might the parental-consent based model limit the ability of ado- 
lescents to obtain information about “safer sex” or how to deal with trauma, depres- 
sion, family abuse, or addiction. Would an abusive father authorize a teen to visit 
a website about how to report child abuse? Would a parent of an adolescent strug- 
gling with their sexual identity let their kid participate in a self-help social net- 
working page for gay and lesbian youth? 116 What rights are at play here and how 
do we reconcile them? 

Maintaining the ability of kids to participate online interactions goes beyond con- 
tent that most people would recognize as “serious” — from the perspective of both 
First Amendment values and the education of children. As a recent MacArthur 
F oundation study of the online youth Internet use concluded: 

Contrary to adult perceptions, while hanging out online, youth are picking up 
basic social and technological skills they need to fully participate in contem- 
porary society. Erecting barriers to participation deprives teens of access to 
these forms of learning. Participation in the digital age means more than being 
able to access “serious” online information and culture. 117 

It was at least in part in recognition of such difficult First Amendment questions 
that Congress removed the requirement in the initial legislative draft of COPPA 
that would have required Pi-based sites to “use reasonable efforts to provide the 
parents with notice and an opportunity to prevent or curtail the collection or use 
of personal information collected from children over the age of 12 and under the age 
of 17.” 118 

Even if parents have an absolute right to block their adolescents’ access to such 
data, they can already exercise that right by applying strict controls on the com- 
puters in their home. COPPA 2.0 proposals go well beyond recognizing this right 
by setting the default to “parental consent required” for adolescents to access a wide 
range of content — meaning that parents must “opt-in” on behalf of their children be- 
fore their children can participate in Pi-collecting sites. This, in turn, burdens the 
ability of adolescents to communicate, because their parents might censor (rightly 
or wrongly) certain information, or simply fail to understand the technologies in- 
volved or to be actively engaged. But whatever the free speech rights of adolescents, 
if anyone should be interfering with those rights, it should be their parents — not the 
government. 

Some parents may object that, however effective parental control software may be 
in the home, it does not allow parents to control what their kids’ access outside the 
home. This argument is understandable on some level, but in the end, it amounts 
to a demand that roadblocks be put up everywhere for the sake of particularly sen- 
sitive parents at the expense of everyone else in society, including potentially huge 
numbers of adult users — and of online anonymity in general. 


May 18, 2009, http: / / fjallfoss.fcc.gov / prod /ecfs / retrieve, cgihiative or pdf=pdf&id docu 

ment=652021 6901 . 

115 See generally Solveig Singleton, Privacy Versus the First Amendment: A Skeptical Ap- 
proach, 11 Fordham Intell. Prop. Media & Ent. L.J. 97 (2000), available at http :/ / 
Iaw.fordham.edu/publications/articles/200flspuh6588.pdf; Eugene Volokh, Freedom of Speech 
and Information Privacy: The Troubling Implications of a Right to Stop People from Speaking 
About You, 52 Stan. L. Rev. 1175 (2000), available at www.law.ucla.edu/volokh/privacy.htm. 

116 “There are parents who, for a variety of reasons (political, cultural, or religious beliefs, ig- 
norance of the facts, fear of being exposed as abusers, etc.), would deliberately prevent their 
teens from accessing social-network sites (SNS).” ISTTF Final Report, supra note 8, Appendix 
F, Statement of Connect Safely, at 262 (listing examples of unintended consequences of age 
verification mandates). 

117 John D. and Catherine T. MacArthur Foundation, Living and Learning with New Media: 
Summary of Findings from the Digital Youth Project, at 2 [hereinafter MacArthur Study] 
http:/ / digitalyouth.ischool.berkeley.edu / files / report / digitalyouth-WhitePaper.pdf. 

118 This requirement was contained in the original bill, supra note 14 § 3 ( a)(2 )( A)( iii ) , but was 
removed when that bill was reintroduced in its final form. In the interim. Congress held a hear- 
ing at which testimony was offered by, among others, Deirdre Mulligan of the Center for Democ- 
racy and Technology, which generally supported COPPA but argued for the very revisions that 
were ultimately made. In particular, Mulligan argued that: 

Under the bill each time a 15 year old signs-up to receive information through e-mail his or 
her parent would be notified. For example if a 15 year old visits a site, whether a bookstore 
or a women’s health clinic where material is made available for sale and requests information 
about purchasing a particular book or merely inquires about books on a particular subject 
(abuse, religion) using their e-mail address the teenager’s parent would be notified. This may 
chill older minors in pursuit of information. 

Mulligan Testimony, supra note 15. 
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But Illinois’s COPPA 2.0 proposal goes even further, not merely expanding 
COPPA to cover a particular variety of social networking sites, 119 but requiring that 
such sites “allow the parent or guardian of the minor unrestricted access to the pro- 
file web page of the minor at all times.” 120 Congress considered just such a parental 
access mandate in the initial draft of COPPA legislation back in 1998, but ulti- 
mately removed it from the final version of the legislation, 121 apparently because 
even some of COPPA’s supporters worried, given the bill’s initial application to the 
13-16 age bracket, that “The establishment of a parental right to access all personal 
information about a teenager may intrude on older minors’ privacy, rather than pro- 
tect.” 122 

C. Communication between Adolescents & Adults 

Finally, COPPA 2.0 could infringe on the free speech rights of adults to commu- 
nicate with adolescents online by driving Pi-collecting sites to segregate users by 
age or to attempt to block access by adolescents. The vast majority of adult-minor 
interactions online are not of a harassing or predatory nature — indeed, they gen- 
erally involve adults looking to help or assist minors in various ways. As the Mac- 
Arthur Foundation study cited above concluded: 

In contexts of peer-based learning, adults . . . have an important role to play, 
though it is not the conventionally authoritative one. In friendship-driven prac- 
tices, direct adult participation is often unwelcome, but in interest-driven 
groups we found a much stronger role for more experiences participants to play. 
Unlike instructors in formal educational settings, however, these adults are pas- 
sionate hobbyists and creators, and youth see them as experienced peers, not 
as people who have authority over them. These adults exert tremendous influ- 
ence in setting communal norms and what educators might call “learning goals,” 
though they do not have direct authority over newcomers A 23 

A substantial portion of those interactions involve parents talking to their own 
kids, older and younger siblings communicating with one another, teachers and 
mentors talking to their students, or even co-workers of different ages commu- 
nicating. Even when adult-minor communications involve complete strangers, there 
is typically a socially-beneficial purpose. Think of two people — one an adult and one 
a minor — debating politics on a discussion board, or creating a Wikipedia entry to- 
gether. What about a Presidential campaign website that involves millions of volun- 
teers of all ages communicating and collaborating to a common purpose? There are 
countless other examples. How would such interactions be affected by COPPA 2.0? 
Restricting such interactions would raise profound First Amendment concerns about 
freedom of speech as well as of association. 

In any First Amendment analysis, a court must consider not only the free speech 
rights at stake and the availability of less restrictive alternatives to regulation, but 
the governmental interest being advanced. Again, neither COPPA nor the COPPA 
2.0 proposals discussed herein (in New Jersey and Illinois) requires exclusion of 
older users from a website, nor directly governs the sharing of personal information 
among users (where that sharing does not also constitute collection by the site 
itself). But separation of adolescents from adults is likely to be an indirect effect 
of COPPA 2.0 requirements — as COPPA 2.0 advocates probably realize — because, 
once Pi-collecting sites are required to age-verify users, they will face reputational, 
political and potentially legal pressure to make interactions between adolescents 
and children more difficult in the name of “child safety.” More subtly, if Pi-collecting 
site operators have an incentive to avoid being considered “directed at” adolescents, 
they will also have an incentive to discourage adolescent participation on their 
site — which achieves a similar result. 

Here, one must further ask if attempting to quarantine children from adults (how- 
ever indirectly) actually advances, on net, a strong governmental interest in child 
protection. Such a quarantine is unlikely to stop adults with truly nefarious inten- 
tions from communicating with minors, as systems designed to exclude participation 
by adults in a “kids-only” or “adolescents-only” area can be easily circumvented. 
Given the lack of strong identity records for minors, it’s much easier for an adult 


119 See supra note 74. 

120 SNWARA, supra note 11, § 10(c). 

121 The original COPPA bill required that parents have “access to the personal information 
of the child of that parent collected by that website,” S. 2326, supra note 14, § 3(a)(2)(iv)(I), while 
the bill as passed instead requires only that parents be given “a description of the specific types 
of personal information collected from the child by that operator,” 15 U.S.C. § 6502(b)(l)(B)(It 
(emphasis added). 

122 See Mulligan Testimony, supra note 118. 

123 MacArthur Study, supra note 117, at 39 (emphasis added). 
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to pretend to be a minor than vice versa. The effect of age stratification on truly 
bad actors is likely to be marginal at best — or harmful at worst: Building walls 
around adolescents through age-verification might actually make it easier for preda- 
tors to target teens, since a predator who gains access to a supposedly teen-only site 
will be less likely to be exposed as a predator by targeting an adult they think is 
a teen. So for the sake of marginal (if any) gains in child protection, would we not 
be excluding beneficial interaction between adults and minors? 

To hear some of the advocates of COPPA 2.0 talk about how teens currently be- 
have online, one might think that online environments in which adolescents were 
left to their own devices — imagine a “Teen MySpace” for the 13-17 crowd, walled 
off from the rest of MySpace — would be far worse, perhaps an online version of Lord 
of the Flies. These concerns are clearly exaggerated: The critics frequently complain 
about “the way kids talk to each other these days” while looking at their own past 
adolescent banter with rose-colored lenses. What is clear is that adolescents (and 
young adults) behave better in online environments where adults are present, too. 
Perhaps the best demonstration of this fact has been the uproar from adolescents 
and young adults that has accompanied Facebook’s explosive growth in popularity 
among older users in recent months. 124 Many kids hate the idea of adults joining 
Facebook precisely because the presence of adults encourages kids to “self-regulate” 
by exercising better judgment and following better netiquette. 125 

Anne Collier, founder and executive director of the child safety advocacy organiza- 
tion Net Family News, Inc. and editor ofNetFamilyNews.org and ConnectSafely.org, 
suggests that the push for “segregation” by age (e.g., creating a teen-only version 
of Second Life) for safety’s sake is “losing steam” because: 

it’s a response to the predator panic teens and parents have been subjected to 
in U.S. society, not to the realities of youth on the social Web. What nearly a 
decade of peer-reviewed academic research shows is that peer-to-peer behavior 
is the online risk that affects many more youth, the vast majority of online kids 
who are not already at-risk youth offline. Segregating teens from adults online 
doesn’t address harassment, defamation, imposter profiles, cyberbullying, etc. It 
may help keep online predators away from kids (even though online predation, 
or abuse resulting from online communication, constitutes only 1 percent of 
overall child sexual exploitation . . .), which is a great outcome, but it’s not 
enough unless all that parents are worried about is predators. 126 

Collier discusses the particularly acute problem of “actual or perceived sexual ori- 
entation and gender expression,” which the Salt Lake Tribune has noted are “two 
of the top three reasons secondary school students said their peers were most often 
bullied at school.” 127 This kind of harassment recently attracted widespread public 
attention after two 11-year-old boys committed suicide after experiencing anti-gay 
harassment and bullying at school. 128 

Nationwide, “Lesbian, gay, bisexual, transgender and questioning youth are up to 
four times more likely to attempt suicide than their heterosexual peers.” 129 This 
child safety risk is painfully real, with anti-gay harassment being only its most obvi- 


124 Justin Smith, Number of U.S. Facebook Users Over 35 Nearly Doubles in Last 60 Days, 
Inside Facebook Blog Mar. 25, 2009, www.insidefacebook.eom/2009/03/25/number-of-us- 
facebook-users-over-35-nearly-doubles-inlast-60-days / . 

125 See, e.g., Lori Aratani, When Mom or Dad Asks To Be a Facebook “Friend,” The Wash- 
ington Post, Mar. 9, 2008, www.washingtonpost.com/wp-dyn/content /article / 2008 / 03 / 08 1 
AR2008030801034.html. ‘“I do not know if this has happened to anybody, but this morning I 
log on to Facebook and I have a new friend request!’ wrote 19-year-old Mike Yeamans, a sopho- 
more at James Madison University, on one of several ‘No Parents on Facebook’ groups that have 
popped up on the site. ‘I am excited to make a new friend so I click on the link. I could not 
believe what I saw. My father! This is an outrage!”’ Id, 

126 Anne Collier, Where Will OnlineTeens Go Next?, May 1, 2009, www.netfamilynews.org/ 
2009 / 05 / wherewill-online-teens-go-next.html (internal citations omitted). For evidence of at-risk 
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Finkelhor & Kimberly Mitchell, Crimes Against Children Research Center, Trends in Arrests of 
Online Predators, 2009) www.unh.edu / ccrc / pdf / CV194.pdf; see also, Anne Collier, Major Up- 
date on Net predators : CACRC study, March 31, 2009, www.netfamilynews.org/2009/03/major- 
update-on-net-predators-mostly.html (summarizing study). 
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Suicide: Addressing Harassment in Schools, Salt Lake Tribune, April 24, 2009, www.sltrib.com/ 
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ous form. But “segregating” teens from adults seems likely to aggravate this prob- 
lem by removing adults from the mix as a potential source of discipline. 

Of course, adults play a critical role in disciplining interaction among the 0-12 
age bracket, but not as direct participants in on-site interaction. Again, how many 
adults actually want to use Club Penguin? Instead, parents can supervise what 
their kids do online through parental control software. Parents could, of course, use 
that same software to monitor what their adolescent kids do, too. But as kids get 
older, most parents realize that the training wheels have to come off at some point. 
Few parents will want to spy on their 17-year-old until the day before the kid starts 
college (or enlists in the military or gets married). But most parents probably would 
prefer that, if their kids are interacting in an online environment, they think twice 
about what they do and say online. It is by no means clear that restricting online 
interaction between teens and adults will serve that end. 

VII. The Commerce Clause Implications of State-Level COPPA 2.0 

State-based efforts to expand COPPA or to impose other forms of age/identity 
verification raise additional constitutional concerns: State-level efforts by state gov- 
ernment or state AGs to push through an expansion of COPPA would likely violate 
the Commerce Clause of the U.S. Constitution. 

For simplicity, the preceding discussion did not consider how Pi-collecting sites 
would respond to COPPA obligations imposed in one U.S. state but not others. Sites 
might default to the “lowest common denominator” of whatever would be acceptable 
in the most restrictive states — especially if those states has populations as large as 
Illinois or New Jersey. But websites could also attempt to configure their services 
to function differently depending on what state the user is in. Thus, age verification 
mandates might also require location mandates (again, perversely requiring the col- 
lection of more information in the name of protecting adolescents’ privacy). If a site 
relied only on location information provided by the user, adolescents would quickly 
learn to lie about what state they live in just as children have learned to lie about 
how old they are to avoid triggering COPPA’s “actual knowledge” requirement. Al- 
ternatively, websites could attempt to determine a user’s location automatically 
based on their IP address, but such “IP geocoding” is not always accurate and can 
be subverted by use of a proxy. 

This technical discussion should help to illustrate why state-level COPPA 2.0 pro- 
posals would burden communication over the Internet, a uniquely “interstate” me- 
dium whose architecture makes it difficult, if not impossible, to isolate the effects 
of state regulation on residents of that state. There is a long string of “Dormant 
Commerce Clause” cases that have consistently struck down state laws attempting 
to regulate commerce (or speech) that originates or takes place outside the state’s 
borders. 130 If it is not possible for a state government to isolate the effects of its 
regulatory actions to merely those Pi-collecting site operators or users living within 
its jurisdiction, Federal courts will block such measures. Consequently, the 
extraterritorial impact of state-based COPPA expansion would likely result in an 
immediate constitutional challenge and such regulation would almost certainly be 
overturned. 

It is also possible that COPPA 2.0 proposals may already be pre-empted by 
COPPA because, although COPPA authorizes state attorneys general to bring en- 
forcement actions under certain circumstances, 131 COPPA bars states from enacting 
any laws “inconsistent” with COPPA. 132 

VIII. Summary of Implementational Challenges Regarding COPPA 
Expansion 

Even if one somehow overcame the many policy and constitutional arguments 
against COPPA 2.0, there would remain a slew of difficult, if not impossible, chal- 
lenges to overcome in implementing such a system. Most critically, the threshold 
practical question remains the same as it does for most other forms of online iden- 
tity verification: How do we verify the parent-child relationship when someone as- 
serts they are the parent or guardian? But there are many other questions regarding 
how well COPPA would “scale up” that must be considered: 


130 See Adam Thierer, The Delicate Balance: federalism, Interstate Commerce, and Economic 
Freedom in the Technological Age at 58—61 (The Heritage Foundation, 1999). 

131 15 U.S.C. §6504. 

132 “No State or local government may impose any liability for commercial activities or actions 
by operators in interstate or foreign commerce in connection with an activity or action described 
in this chapter that is inconsistent with the treatment of those activities or actions under this 
section.” 15 U.S.C. § 6502(d). 
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1. Verification Mechanisms. What sort of mechanisms will need to be put in 
place to guarantee that the parent or guardian is who they claim to be (for both 
initial enrollment and subsequent visit authentication)? Sign-and-fax forms can 
be easily forged, so credit cards (and perhaps mandatory user fees) will likely 
become the default solution. A third method, follow-up phone calls, just doesn’t 
seem practical. But might lawmakers demand a mix of all of the above? 

2. Obtaining Consent. Regardless, how burdensome will those mandates be on 
parents or guardians? As Parry Aftab has noted, “The more difficult we make 
the consent mechanism, the fewer parents we will get to consent.” 133 

3. Costs to Business. How burdensome will those mandates be for Pi-collecting 
site operators? What kind of compliance costs or legal penalties are we talking 
about? 

4. Costs to Users. Will those costs be passed on to users as fees beyond the 
nominal transactions required to achieve verification via credit cards? (Since 
most Pi-collecting sites websites and almost all social networking sites are free- 
of-charge today, that’s not going to be a very popular mandate!) 134 

5. Disparate Socio-economic Effects. How would increased fees or credit card 
mandates impact low-income families and youth, especially those without credit 
cards? 

6. Industry Consolidation. If compliance costs — in the form of additional staff, 
insurance and litigation expenses — explode for website operators, will this cause 
the kind of industry consolidation that seems to have occurred with child-ori- 
ented websites since COPPA’s adoption? Would the increased hassle of access- 
ing new sites lead to consolidation by reducing adoption rates by users? How 
would online innovation and creative expression suffer as a result of such con- 
solidation? 

7. Increased Privacy Risks. Who would collect the massive data bases of infor- 
mation created by such a mandate? Who has access to all that new data? What 
might government use it for if they get their hands on it? 

8. Offshore Sites. Could this new regime be applied effectively to offshore sites? 
Or, will kids flock to offshore sites as a result of such mandates on domestic 
sites? If some do, how will we stop them? 

9. Credential Transferring. Even if the parental permission verification process 
worked during initial enrollment, how would it work in the “subsequent visit” 
stage? Once minors are given credentials or digital tokens, how do we prevent 
them from sharing or selling their credentials? In particular, how do we prevent 
older siblings from sharing their credentials with younger siblings? What would 
be the penalty for them doing so? What about older minors with independent 
access to credit cards? 

10. Law Enforcement Priorities. How many law enforcement or regulatory agen- 
cies will be tasked with administering this regulatory regime? Might this be di- 
verting resources from better priorities, such as serious law enforcement efforts 
and online safety educational programs? 

IX. Conclusion 

The future of age verification battles — at least on the social networking front — 
will likely be fundamentally tied up with COPPA and the question of how well pa- 
rental consent-based forms of age verification might work on a scale larger than 
COPPA’s very limited scale. It is unlikely, however, that such a framework could 
be easily applied on “Internet scale.” There is a world of difference between a site 
like Disney’s Club Penguin, for example, and sites like MySpace or Facebook. This 
ultimately reflects the uniquely insular nature of the under-13 age bracket and the 
lack of any clear line between adolescent-oriented and “general audience” content. 

Moreover, as social networking capabilities become increasingly ubiquitous, inte- 
grated into every site and service — from Change.gov 135 to the San Francisco Chron- 
icle (sfgate.com) to CNN.com, from Microsoft’s Xbox Live service to Linden Labs’ 
Second Life — the costs and hassles of compliance with COPPA 2.0 age verification 
mandates will increase dramatically. Are parents really going to be forced to au- 
thenticate themselves and then their kids for every website their kids want to par- 


133 Aftab Comments, supra note 59, at 5. 

134 Aftab also notes that “Parents do not trust a site to use their credit card to verify their 
consent. They barely trust online credit card use when they want to buy something.” Id. 

135 Like many social networking sites, Change.gov allows users to comment on news items the 
IntenseDebate comment platform, which allows users to create profiles, upload profile photos, 
etc. 
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ticipate in that requires so much as an e-mail address? That mandate seems unnec- 
essary and unworkable. Are other adults going to have to prove they’re not adoles- 
cents? By creating such a requirement, COPPA 2.0 would also constitute a func- 
tional convergence of COPPA with COPA — a law the courts have rejected as incon- 
sistent with America’s tradition of anonymous speech, something central to our evo- 
lution as a democracy, pre-dating even the First Amendment that protects it from 
government interference. 

Finally, the irony of COPPA 2.0 proposals is that lawmakers would be applying 
a law that was meant to protect the privacy and personal information of children 
to gather a great deal more information about them, their parents, and many other 
adults! These privacy implications should make us think twice about trying to ex- 
pand COPPA beyond its primary purpose to encourage parental involvement in 
what kids do online. Even those who support COPPA in its current form should rec- 
ognize that there are better ways to protect adolescents online. 136 
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Senator Pryor. Thank you. 

I want to thank all the witnesses for their testimony. 

And we’re going to start off with Senator Rockefeller. 

The Chairman. Thank you, Mr. Chairman. 

I have this odd feeling about this panel, except you and you and 
you. It’s like we’re discussing some kind of — Is a breakfast cereal 
good for you, or not? And children have somehow already dis- 
appeared from this process. And it comes down, I think — I mean, 
and the both of you — Microsoft, Facebook — had good things to say, 
but you always ended up with the idea, “Well, we can — we’ll do this 
by ourselves, and we really don’t need the government telling us 
what to do.” 

And I have to leave, very shortly, because I have to give a speech 
on cybersecurity to a business group. Cybersecurity is the Nation’s 
number-one national security threat, ahead of 9/lls, dirty bombs, 
weapons of mass destruction, according to all analysis. The private 
companies — this is very parallel to me — they always said, at the 
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beginning, “We” — Olympia Snowe and I have been working on this 
for 2 years — “We can do this ourselves. We don’t want government 
to be involved with this.” We knew that couldn’t happen, because 
we knew that they didn’t have, really, any idea what they were 
doing about how to take on cybersecurity. Some of the larger com- 
panies did, to a certain extent, but, for the most part, they didn’t. 

That’s like parents. We want parents to make these judgments, 
and which is a little bit like saying that some people here don’t 
know how average American families have to live, where people are 
trying to keep down two jobs, and they, themselves, may not be 
skilled on the Internet, and in any event, they’re tired, they have 
things to do. And so, we’ve got to do this for the parents. And so, 
“Well, let’s not let FTC do this, let the Congress do that.” 

Well, maybe that was your idea, because you thought the Con- 
gress wouldn’t be able to pass it. I thought your testimony was par- 
ticularly unhelpful, to be honest with you. I thought both of your 
testimonies were terrific, because you were focused on the problem. 

And, Mr. Rotenberg, or Dr. Montgomery — either one — we 
haven’t, here, discussed, really, what the problem is. And the prob- 
lem is, kids are watching filth. They’re watching filth, and lasciv- 
ious, horrible things, and we’re trying to argue about 13, when, as 
you say, it should be 18 or 22, or whatever. And the companies, 
here, are in favor of cleaning this up, but not at the expense of 
being regulated. They want to do it themselves. They’d appreciate 
working with the FTC a little bit, but the clear message is, they 
want to do it themselves. 

My clear message is, I don’t really think they do. I think money 
trumps on this. Money always trumps when it comes to informa- 
tion. Money always trumps. This committee has come up with so 
many scam hearings in the last year or so. Money drives bad be- 
havior, and then kids, or people, or whoever, or Internet users and 
popup — you know, all of these things are just left to the side. 

So, I’d like you to describe, What damage do you think is being 
done to children by the inaction? And, you know, I agree with you 
some — agree with the FTC; they’re not heavily staffed, they’re not 
well funded. We need to change that. We’re trying to protect them 
from being wiped out altogether under this financial services thing. 
And I think we have. I think we have done that. But, what is the 
damage that you see being done to a generation of kids coming up, 
with parents who are purportedly hovering over, watching every 
move they make, when you know perfectly well they’re not? 

Mr. Rotenberg. Senator, I think the primary problem is that 
young people are being coaxed to reveal a great deal of intimate in- 
formation. And the data is gathered and collected and disclosed to 
strangers, for any purpose that generates commercial value. And, 
as a parent of two teenagers, I have a problem with that. I think 
technology is great, and I want, you know, my kids to grow up and 
to be technologically literate and to make smart decisions online. 
Because I can’t always be there, they need to have the tools and 
the experience to make those decisions for themselves. But, I know 
that there’s a point where, if I can’t help them and they can’t figure 
it out, if the business practices are designed to conceal from them 
what’s really going on. And that’s why I think the Congress needs 
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to act. I think the Congress needs to give kids the ability to control 
how the information about them is being used by others. 

The Chairman. My time is up. Do you have 

Dr. Montgomery. Senator 

The Chairman. — one brief comment? 

Dr. Montgomery. Yes. I mean, I would agree with Marc. We 
have created — industry has created a system of ongoing monitoring 
and surveillance of teenagers, encouraging them. And it taps into 
their natural developmental needs to reach out to their peers and 
to become independent, encouraging them to give out a lot of infor- 
mation, and tracking everything they do, without their knowledge. 
It’s also socializing them into a system where privacy is not valued. 
And I think that’s a very deep loss to our society. 

And then, finally, I do want to respond to what Mr. Szoka said 
about advertising. We’re not talking about traditional advertising, 
here, by the way. We’re talking about viral advertising and brand- 
ed environments and interactive games and Avatars and a whole 
lot of things that are not what you traditionally think about as ad- 
vertising. 

And recent research has found that teenagers can be quite sus- 
ceptible to this advertising; they’re not necessarily aware of all of 
this, and we know they don’t know what’s being done behind the 
scenes. 

The Chairman. I thank you both very much. 

I thank you, Mr. Chairman. 

Senator Pryor. Thank you, Mr. 

Mr. Hintze. Senator Rockefeller, could I make one brief com- 
ment, please? 

The Chairman. Sure. 

Mr. Hintze. I just want to — I apologize if I gave the impression 
that Microsoft does not want government involvement, that we 
want to do this on our own. That’s certainly not the case. We have 
been supportive, for a long time, of a multifaceted approach to pro- 
tecting privacy online, not just for kids, but for all consumers, in- 
cluding our support for comprehensive Federal privacy legislation, 
which we think is essential. 

But, self-regulation certainly plays a role. Industry best practices 
certainly play a role. But, education, law, regulation, and enforce- 
ment also play a role, as well, and we’re very supportive of all of 
that. 

The Chairman. I hear you. 

Senator Pryor. Thank you, Mr. Chairman. 

Senator Wicker. 

Senator Wicker. Well, thank you very much. And this is a very, 
very serious topic, with implications for the next generation. I ap- 
preciate the Chair’s willingness to get into the weeds on this. 

I do think that the testimony of all of our panelists has been 
helpful. I think it’s important that we hear a variety of viewpoints, 
and all sides to this. And I do think that there’s a way to — there 
must be a way to have it both ways, to encourage innovation and 
to protect the privacy of children’s information at the same time. 

So, I’ll ask the panel. What do they think about what I just said? 
Has the law reduced innovation and caused consolidation among 
children’s websites? Have we created a barrier to entry into the 
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children’s website market? Has the law resulted in limitations on 
beneficial content specifically for children? 

So, if we could just start with Ms. Rich and go down the panel, 
that’ll be my question. 

Ms. Rich. That’s obviously — Tim keeps helping me with the but- 
ton, here — that’s obviously one of the key issues that we’re going 
to look at in our review, especially since that was one of the goals 
of COPPA, is to preserve that access, even as kids were protected. 
We did review that issue that last time we reviewed COPPA, which 
was 2005, and we published a report. We sent a report to Congress, 
and we said, at that time, all of the commenters and all of the peo- 
ple we spoke to and the research we conducted indicated it had not, 
that children were being protected, and they still had access, and 
innovation was not being stifled. But, we are very interested in the 
answers to those questions today. 

Mr. Sparapani. Senator, speaking only for Facebook, I can say 
that I have seen a strange disincentive because of the law. My 
whole testimony was focused on trying to identify all of the innova- 
tive things that Facebook has done for the teenaged users of our 
site. But, what you didn’t hear me saying was that we’re not spend- 
ing a lot of energy on the under-13 set, because they’re typically 
not on our site. But, there’s a line that’s drawn between the 13- 
and-over and the 13-and-under, and I think that that line has cre- 
ated a disincentive for companies to work toward innovating on the 
13-and-under side. And I think that we need to look at that. And 
I think that’s the point I was trying to make in my testimony, Sen- 
ator. 

Mr. Hintze. I look forward to seeing what comes out of the FTC’s 
current rule review. I can speak for our own company, that, yes, 
some of the parental consent mechanisms required under COPPA 
can be challenging, and sometimes frustrating to implement. But, 
I think that, for the most part, it has not discouraged us from con- 
tinuing to provide services to general audiences, including young 
children and some specifically tailored to children, as well. It does 
create additional work and additional cost. It’s a barrier to entry, 
in some cases, because anytime you’re designing a sign-up process 
where there’s a speed bump or even in some cases a significant 
barrier in having to involve the parent — yes, some consumers will 
go away and go elsewhere. But, we think it’s in the — for the most 
part, the right thing to do. Involving the parent is the right thing 
to do. Creating those speed bumps so that you can inform children 
about the appropriate use of these services, and help educate their 
parents, is the right thing to do. 

So, I would say, on the whole, COPPA has been successful in en- 
couraging websites to do the right thing, even though there is a 
cost involved. 

Dr. Montgomery. One of the goals of the law was to minimize 
this massive data collection that was really becoming state-of-the- 
art in the early days of the dot-com boom and e-commerce. And I’m 
telling you, that is where the business was headed. So, what we 
were able to do — and, again, I repeat that we were worked with in- 
dustry to come up with a set of principles that would honor the pri- 
vacy rights of young people, but, at the same time, not interfere 
with the healthy development of e-commerce. 
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But, if you’re going to market to kids, what we were able to es- 
tablish is, there need to be some operating principles, here. And I 
think the industry has done a very good job of working that out. 
It was not easy to sit around the room and try to figure out, “OK, 
how do we do this?” You know, the parental verification mechanism 
was a tricky one, not easy to do. But, the idea was, first, enable 
the parents to know what their children are doing, and, second, 
make the industry aware that they have a responsibility, when 
they are collecting personal information from children. 

We’ve seen a growth — a healthy growth of lots of wonderful 
websites for kids, lots of terrific content areas. And I think that has 
been a very, very good development, and I’m happy about it. 

As I said, I think the 13 is not — kids don’t become automatically 
mature at 13, as any parent can tell you. But, at that time, we de- 
cided, “Let’s create this clear mark, here, for where we will have 
these guidelines.” And now, I think we’ve seen a whole new devel- 
opment, with the web, that raises the issue about how — “OK, now 
what do we do about teens?” Again, not the same model, but, What 
can we do to ensure that they’re treated fairly in this digital mar- 
ketplace? 

Mr. Rotenberg. Thank you. 

Senator I just want to say, I very much appreciate your question 
about the relationship between innovation and privacy. And I sus- 
pect we’re going to hear a lot more about this. 

But, if I could say, directly, sir, I think the relationship is not 
generally well understood. I don’t see this as a tradeoff. My wife 
is a public schoolteacher. When we talk about innovation in the 
technology field and privacy, we think in terms of the privacy safe- 
guards that enable children to take advantage of new technology. 
In other words, in the absence of privacy protection, I think you ac- 
tually diminish the opportunity for technical literacy and training 
and education that parents and educators would like to see happen. 

The real innovation that people are talking about, which is what 
they’re not saying explicitly, is on the marketing side. They don’t 
like the privacy rules, because they don’t want to do the types of 
behavioral targeting, brand-based targeting, you know, “get your 
child to friend an advertising figure” targeting. That’s the innova- 
tion they have in mind, and that’s why they object to the privacy 
rules. 

But, if we take a step back and talk about technical literacy, 
bringing more children to the online environment, creating great 
products and services so that they get excited about new tech- 
nology, privacy actually plays a very big part in helping to make 
that happen. 

Senator Wicker. Before we move to Mr. Szoka, let me follow up, 
Mr. Rotenberg. You mentioned that you have children. I take it 
that they are teenage? 

Mr. Rotenberg. Yes, sir. 

Senator Wicker. Do you mind telling us how old they are? 

Mr. Rotenberg. Fifteen and sixteen. 

Senator Wicker. OK. And I dare say that, in terms of knowledge 
about the protections that children need, you’re probably in per- 
centile 99.9 

Mr. Rotenberg. Right. 
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Senator Wicker. — nationwide. That being the case, what do you 
need the government to do for your above-age-13 children, that it’s 
not doing now? 

Mr. Rotenberg. I need the government 

Senator Wicker. Because you’re a good parent. 

Mr. Rotenberg. Yes. Well, I appreciate that, sir. But, I need 
government to step in to control the things we can’t control. In 
other words, if we sit down with our children and go through the 
privacy settings and say, “This makes sense,” or, “This doesn’t 
make sense,” or, “That’s really your call,” and that’s how we under- 
stand privacy protection, and then, the next week, the company 
says, “We’ve got a whole new approach now. We’re going to do 
something different,” and we’re left with a sense that the tools that 
the company provided us to try to safeguard our privacy and the 
privacy of our children have basically become meaningless. 

So, I — I’m not saying that parents don’t play an important role. 
I think parents do. But, I’m saying it can’t be made so difficult. 
And the businesses can’t hide the way they collect and use data, 
as they do, because there’s nothing that the user — the parent can 
do to change that. That’s completely on the business side, and it’s 
done because there is no regulation. There’s nothing that prevents 
them from saying, to all the teenagers who they have data on right 
now, “You know, we’ve got a great idea, and we want to just go 
ahead and do this,” or not tell them and go ahead and do it. Par- 
ents can’t control that. 

Senator Wicker. Thank you. 

Mr. Szoka, you can respond to that, but also to the question 
about innovation versus privacy. 

Mr. Szoka. Well, thank you, Senator. 

Let me be clear about three points. 

First, there are always tradeoffs involved in regulation. And 
here, the tradeoff is not simply a question of economics versus pri- 
vacy, but, indeed, the tradeoff involves free speech. And again, I 
stress that that’s because “collection,” as the term is used in 
COPPA, does not just apply to collection, as we mean it in the col- 
loquial sense, such as is used for advertising or marketing pur- 
poses. But, under the statute, it’s any sharing of information. It is 
the enabling of sharing of user-generated content. 

So, when I talk, here, about the tradeoffs, I want to be very clear, 
I am talking about the ability of users to join tools, and the innova- 
tion in those tools that allow them to share and communicate and 
collaborate. And that’s — this has been the flourishing of the Web 
2.0. And that is exactly what is at stake here if COPPA were to 
be expanded in its age scope. 

So, my second point is, I wanted to emphasize that I think one 
of the beauties of COPPA is that it gives the FTC great flexibility 
in shaping the rule within the confines given to it by Congress. So, 
the FTC has the flexibility to update the definitions of “personal in- 
formation” and “Internet,” and I encourage it to do so. 

My caution, however, was that we ought to be very, very careful 
about having Congress reopen the door to the one thing that the 
FTC cannot, on its own, change, which is the age scope. And I men- 
tioned the financial reform legislation only because that could, in- 
deed, give a future FTC the ability to change things like the age 
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scope, which, again, presents an important tradeoff, in terms of 
free speech. 

My final point is, there is a rich mosaic of parental control tools 
and software and methods available today. My colleague, Adam 
Thierer, at the Progress & Freedom Foundation, has published a 
comprehensive compendium of those tools. And again and again, in 
the context of filth, as Senator Rockefeller referred to, wanting to 
prevent or censor kids from accessing, the courts have repeatedly 
said that those tools need not be perfect, but the government regu- 
lation must yield to the tools, where they exist. And so, our point 
has been to highlight that these tools exist, and that we should be 
encouraging innovation, not just in the sharing of information, but 
also innovation in the controls that are available to parents, as well 
as all users, to take, really, control over their own information and 
how it’s shared. 

And so, our answer, in a nutshell, is that the solution to all these 
concerns should, first and foremost, be enforcement of the existing 
law, which applies to, again, children under 13, and then also edu- 
cation and empowerment. And government has a role to play, a 
very important one — and the FTC does this extremely well — in 
highlighting those tools, methods, and education. And I encourage 
it to do so, but, again, caution against changing the statute, itself. 

Senator Wicker. Thank you. 

Senator Pryor. Thank you, Senator Wicker. Thank you for being 
here. And I know you have to slip out to another meeting, but 
thank you for your leadership. And we will leave the record open 
for a few days for Senators to submit their questions, if they want 
to. 

Let me, again, thank all of our witnesses, but I want to thank 
Facebook and Microsoft for being here, because I know not every- 
one in the industry chose to come today. But, let me start, if I can, 
with a question for Facebook. 

In your written testimony, you talk about “Facebook’s culture of 
authentic identity.” Could you elaborate on that a little bit? 

Mr. Sparapani. Yes, Senator, and I’m glad that you asked. 

One of the really interesting things that happened when 
Facebook was first launched is, we defied conventional wisdom at 
the time about privacy and security. We decided that, at the begin- 
ning, we were going to ask people to put their real names and build 
their entire profile around that. And I have to tell you, it has been 
the — really, the wellspring of a number of advantageous security 
and privacy benefits for users of all ages of our site. 

Again, it was unconventional at the time, but what is meant is 
that we’re able to really deter bad behavior; we’re able to identify 
fake accounts quickly; we’re able to target corrective action at an 
explicit account; and, more importantly, there’s this community ef- 
fect that takes place, where individuals feel some sort of reproba- 
tion when they take an action which is tied to their name. It tends 
to discourage bad speech, bullying, bad behavior, et cetera. And so, 
we’ve really been the beneficiary of this decision of, what we refer 
to as, a real-name culture. 

Senator Pryor. That’s good. 

And you also mentioned in your testimony that you didn’t want 
to see any changes to COPPA. 
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Mr. Sparapani. We’re not really needing changes at this point, 
because we feel we’ve done, really, a very good job of implementing 
the statute 

Senator Pryor. Let me interrupt, right there. 

Mr. Sparapani. Please. 

Senator Pryor. You’re saying that’s true for your company. 

Mr. Sparapani. It is. 

Senator Pryor. Are you saying that’s true industrywide? I mean, 
is everybody a good actor out there? 

Mr. Sparapani. No, of course not. And, you know, there certainly 
are companies which are outliers, there always will be. And that’s, 
frankly, why we need stepped-up FTC enforcement, to find those 
bad actors and take action. 

Senator Pryor. So, your view is, leave the statute as is, but beef 
up the enforcement? 

Mr. Sparapani. Yes, I think that’s the right approach, Senator. 
I think the FTC folks do a generally good job, and they would do 
better if they had more resources. 

It’s really easy to focus on the Microsofts and the Facebooks, the 
Googles, and the Apples, because we’re here, and we can show up 
and testify. It’s the companies that don’t have people here in Wash- 
ington, that don’t have lawyers on staff, that probably deserve the 
lion’s share of attention; they don’t get it, because the press can’t 
focus on them, and they can’t be found. 

Senator Pryor. Tell me why you like the age 13, and why you 
think that shouldn’t change. 

Mr. Sparapani. Well 

Senator Pryor. My, just general inclination would be, “Hey, this 
is a children’s issue, you should make it, 18 and under,” or, some- 
thing like that, move it up a few years. But, tell me why you like 
13. 

Mr. Sparapani. Well, first of all, Senator, my expertise is in pri- 
vacy, and it’s not really in child psychology or social development. 
So, I can only speak from this perspective. We have found that 
teenaged users have really had a, really, very successful experience 
on Facebook. They’re socialized well, they learn good rules of be- 
havior, they are able to actually advance themselves and learn 
about the world around them. 

So, what — I would not want to see us deny teenagers the oppor- 
tunities of living in a digital society. I think it would hamper kids 
around our country, and set them back, vis-a-vis children of the 
same age in other countries, if we were able — if we were to prevent 
them from having access to these sites or services. 

Senator Pryor. OK. 

I think — Dr. Montgomery, did you have a comment on that? 

Dr. Montgomery. Yes. And I would agree that social networks, 
and the Internet in general, are terrific tools for young people. I’m 
also the mother of a teenager, and I can see what a great role these 
new digital technologies are playing in her life, and they really do 
tap into the key developmental tasks of adolescence, when adoles- 
cents are exploring their identities and they’re trying to reach out 
to their peers and really separate from their parents, which is 
something that they need to do, and be more autonomous. So, I can 
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really see that. And a number of my colleagues have done terrific 
research that documents all of that; I think that’s great. 

And I — but, I think the problem is that teens are out there in 
very public and very transparent — in many ways that sometimes 
alarms parents, on these social networks. But, the business prac- 
tices of data collection and surveillance that’s taking place on 
Facebook and other social networks is not transparent. It is really 
a black box, in many ways. 

And I would not be talking about restricting teens from having 
access to these platforms. I think we need to give them that access; 
they’re very important. But, I — what I would be calling for, and 
what I do call for, is for the government to play a role in ensuring 
that all of these social networks, and all of the platforms, mobile 
and otherwise, that young people are engaged in, are operating by 
a set of rules. These rules can be crafted in a way that will balance 
free speech, that will balance business and innovation. 

When we started talking about COPPA, a lot of people said, 
“Well, we’ll never be able to do this, this is impossible.” We were 
able to work it out. And again, not the model that we have for 
COPPA, not the model of parental verification and restricting ac- 
cess, but a separate set of principles that I think we could work 
out together that would apply to teenagers. 

Senator Pryor. Let me ask you, Dr. Montgomery, are there a set 
of principles that exist right now? Is there a model rule out there 
that we could apply here? Or do we have to start this from scratch? 

Dr. Montgomery. Well, I think at the very least, the — some of 
the international principles — OECD principles, for example, that 
Marc can talk to about data minimization and transparency and 
other things that we would expect — you know, I don’t see a model 
out there, as yet. I think we’re inventing some of these things, as 
we did with COPPA, but I think this is the right moment to do so. 

Senator Pryor. And while I’m on you, Dr. Montgomery, should 
we leave age 13 as is, or should we change it? 

Dr. Montgomery. I think COPPA operates well as it is. I’m not 
necessarily talking about revisiting the actual legislation, but I do 
think we ought to think about what protections we could provide 
for teens. And again, I think we need to be careful about the model 
that we create, that I don’t want to see teens totally ignored. 

Senator Pryor. OK, Mr. Sparapani, let me ask you, you all ap- 
parently have a “report” button. And how often is that used? I 
mean, do you track that? What are the numbers on that? 

Mr. Sparapani. Well, Senator, I don’t have the numbers, here, 
immediately in front of me. But, I have to tell you, it’s enough to 
keep a huge team of employees busy, all day, day and night, from 
around the world. When you have 400 million users, which we do, 
and they’re trained, because they’ve become comfortable with self- 
reporting, what they consider to be inappropriate behavior by oth- 
ers on the site, it does produce a large quantum of reports. 

And, of course, we triage those. We take the ones that might 
have a law enforcement component, we put those at the top of the 
list, in terms of responding. We put the ones that concern potential 
threats to life and limb — and it only happens rarely — but, we put 
those, and we prioritize those. And so, these other reports about 
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other malicious behavior or inappropriate speech drop down a cer- 
tain notch. 

Senator Pryor. And does your company have policies that go be- 
yond COPPA? I mean, it sounds like you all have a set of policies 
that really go beyond the law. 

Mr. Sparapani. Well, I guess the one place where I would sug- 
gest this is in — with respect to our marketing practices. I want to 
distinguish Facebook from virtually all other companies I know, 
and from some of the generalized discussion that has been hap- 
pening about marketing to teenagers. 

With respect to marketing to teenagers, Facebook never, ever 
shares information with the advertiser about individual users; 
doesn’t matter the age of the user. What we do is, when we get a 
request to advertise on our site by a company, we offer the ad, but 
we never share the actual personal identifiable information with 
that advertising company. And I think it’s important that people 
recognize 

Senator Pryor. You give them aggregate information about your 
users, but not specific information? 

Mr. Sparapani. That’s exactly right. I think it’s an important 
protection. And I think it has really helped our company succeed. 
And I hope other companies will follow our lead on that. 

Senator Pryor. Mr. Hintze, let me ask you, I know that Micro- 
soft, through, you know, your various software products, offers a lot 
of parental controls. Do you know what percentage of your users 
actually utilize the parental controls? Do you have a sense of — even 
a kind of rough percentage of what that might be? 

Mr. Hintze. Yes, I don’t have the actual numbers with me, and 
I think it probably depends on the service itself. 

Things like Xbox Live, for example, the parental controls are 
really built in as part of the account creation process. So, when a 
parent buys an Xbox and signs up for an Xbox Live subscription, 
part of that transaction of creating secondary accounts for their 
children put those parental-controls choices in front of the user. So, 
it’s quite a high percentage of users who are children, where their 
parents are utilizing those controls to some level. And there are all 
kinds of different knobs and dials in there; and how deep the par- 
ents go probably depends on the parent. But, a large percentage of 
users are using that. 

Other services, you know, we’ve got this Windows Live Family 
Safety, which is a free download for people to use to help control 
how kids are surfing the Net and using search services. 

You know, there’s a challenge of educating parents and making 
them aware of these tools, and it’s something that we try to do, but 
it’s always hard to reach those parents. One of the reasons why we 
have implemented parental consent processes, even in cases where 
we think COPPA doesn’t explicitly require it because it’s a general 
audience site, for example, we think that’s an opportunity to pro- 
vide that kind of education to parents, to get some of these tools 
and information in front of them. 

So, it really depends across the service, I think. 

Senator Pryor. Let me ask about your — you call it Windows Live 
Family Safety? 

Mr. Hintze. Yes. 
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Senator Pryor. Let me ask about that product. That’s free? 

Mr. Hintze. Yes, it is. 

Senator Pryor. And how do parents find out about that? 

Mr. Hintze. We provide messaging in a variety of different ways. 
We have worked with a number of organizations — children’s orga- 
nizations — to provide information through those, the Boys and 
Girls Clubs and other organizations like that. We’ve provided infor- 
mation through our own sites; we’ve got dedicated Web pages 
around privacy and children’s safety on our websites to provide in- 
formation to parents. So, there are a variety of means about how 
we try to get, sort of, the word out on these different tools that are 
available to parents, get them educated about the risks of children 
online and the risks that those children face and the tools available 
to them, to help protect them. 

Senator Pryor. Yes, I think it would be helpful for parents — and 
you may already be doing this, I’m just not aware of it with this 
product — but, I think it would be helpful for parents if you guys 
could take the offensive and aggressively, periodically, from time to 
time, whatever’s appropriate, offer almost like a parent’s toolkit on 
how to stay safe online. 

And there are a lot of aspects of that. I mean, there’s identity 
theft; there are a lot of fraud issues; there are just privacy issues 
with kids or with — I mean, you know, just really kind of runs of 
the gamut. And does Microsoft offer that, kind of in one place, 
these kind of, you know, semi-regular reminders that these tools 
are available, and, “You need to update your settings,” et cetera, 
et cetera? Do you all do that, or is that not 

Mr. Hintze. We do have 

Senator Pryor. — proper etiquette 

Mr. Hintze. Yes. 

Senator Pryor. — you know, in your company? 

Mr. Hintze. We do have the equivalent of tool kits available. 
We’ve got a website that has a list of resources available to par- 
ents, and information available to them, to help educate themselves 
and their children about the risks online. Again, the challenge is 
making them aware of that. And 

Senator Pryor. Yes. 

Mr. Hintze. — and there are certainly things that we have done 
in the past, sort of, quasi-marketing campaigns to parents, to try 
to get that information in front of them. And there’s obviously more 
we can do in the future. 

Senator Pryor. Yes, I’m not a — personally, I’m not a huge Inter- 
net user. I mean, I use it probably every day, but not extensively 
every day, and usually not very extensively at all, but, you know, 
I wasn’t aware of that. So, if I’m kind of like Average John Q. Par- 
ent, here, I didn’t know that was out there. So, I would hope that 
Microsoft and other companies would think about ways to be a lit- 
tle more aggressive in letting people know. 

Let me go ahead and ask Mr. Szoka about the age 13. You want 
to keep 13 where it is? 

Mr. Szoka. Senator, yes, I think you’ve asked the most important 
question of the day. The point that I’ve tried to raise is — this is 
perhaps the least well understood aspect of COPPA. And the point, 
here, is not necessarily just to deal with child psychology, although 
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13 does happen to be the age at which Jewish kids are Bat 
Mitzvahed, the Confirmation is given in the Catholic Church. 
Romeo and Juliet were 13. There are reasons why 13, historically, 
has been an age of transition and, indeed, was chosen by Congress. 

But, the point that we’ve tried to stress in our work at PFF has 
been that the far more important reason for keeping it at 13 is 
that, when you raise that age above 13, the COPPA framework 
breaks down. Because, again, as I said, COPPA basically applies, 
in two ways: It applies to sites that are required to presume that 
all of their users might be a child, and then again where sites have 
actual knowledge. And so, if you were to set that at 18, for exam- 
ple, you would end up in a situation where sites that were — that 
might be considered directed at adolescents, or might be afraid that 
the FTC would find them to be so, are sites that differ profoundly 
from sites that are, today, like Club Penguin, really, truly directed 
only at kids under 13. And the difference is, adults use those sites 
that teens use, as well. 

And so, as a practical matter, if you extended the COPPA frame- 
work to a higher age, you would, for the first time, have the gov- 
ernment be requiring age verification of large numbers of adult 
users. And we’ve already been down that road before. The courts 
have very clearly held, in the litigation about the Child Online Pro- 
tection Act, or COPA, that to do so would be unconstitutional be- 
cause it would infringe on the free speech rights of users to access 
content without having to identify themselves, such as through use 
of a credit card, but also the free speech rights of the sites them- 
selves, to reach an audience, which is diminished by the roadblock 
of age verification. 

So, I want to be clear that, from my perspective, this is the most 
important issue that we’ve talked about here today, understanding 
why that age for COPPA must be kept at 13 for the framework of 
the — of what I think is a really great statute, otherwise, to function 
effectively. 

Senator Pryor. Thank you. 

Mr. Rotenberg, do you agree that COPPA breaks down if you 
change the 13-year-old threshold? 

Mr. Rotenberg. Yes, I’ve been sitting here, listening to Mr. 
Szoka’s comments, and I’m just very confused. I actually helped 
litigate against the COPA, which was the Act that raised the First 
Amendment concerns. And on that side, he and I are actually on 
the same page. 

But, it is almost completely unrelated to the discussion we’re 
having about age verification and COPPA. As Mr. Sparapani ex- 
plained, every person of any age who wants a Facebook account 
has to, in the first instance, provide information about their actual 
date of birth; that’s how they make the determination whether 
someone’s above 13 or below 13. And presumably, they could do the 
exact same line drawing exercise at age 18. So, this argument actu- 
ally doesn’t make any sense to me. 

But, what I — what Mr. Sparapani said, which I think is some- 
thing that needs to be considered more carefully — and I understand 
where he’s coming from — he said, basically, Facebook made a deci- 
sion, for children under 13, “We just don’t want to have them as 
users.” In other words, “It’s too complicated; and because of the 
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COPPA obligations, we’re just going to say, you know, ‘Wait a few 
years,’ basically.” And he suggested, in his answer, that if Congress 
were to extend the line to 18, perhaps they would make the same 
decision now for kids between the ages of 13 and 18, which is obvi- 
ously not what we’re suggesting. We’re not saying that teenagers 
shouldn’t be on social network services. We’re saying that compa- 
nies that provide social network services to teenagers should have 
some legal restrictions on the collection and use of data about those 
children. And I think that can be done without too much difficulty. 
It would probably be based on COPPA; you probably want to make 
some changes. 

But, that’s the main legislative recommendation I would make: 
create some legal protections for teenagers. Don’t discourage them; 
I agree with others, it’s a good service. But, as it is right now, it’s 
not providing adequate protection. 

Senator Pryor. Let me ask about age verification. I know some 
companies may differ with me on this, but my impression is that 
there’s really not a way that exists, yet, to truly get rock-solid age 
verification. And filling in your birthday — obviously, kids can just 
put in a different date and, you know, they may be off to the races. 
So, am I wrong on that? Is — that there’s not a really good, solid 
way to do age verification yet? Or, tell me — tell me what — the 
state-of-the-art right now. 

Mr. Rotenberg. Well, it has always been a challenge. And I 
think you’re exactly right to say that there is no, you know, rock- 
solid way to do it. There are a number of different techniques. 
Facebook itself, I think, has developed some pretty good systems to 
do age verification. I think they probably get it right at a very high 
level, which is to say, I would be very surprised if there were a 
large number of accounts for kids under 13. There may be some out 
there; I suspect that’s true. But, I don’t think it’s a very large num- 
ber. 

And I think a similar, you know, effort to move the age line to 
18, there will probably be some people who get, you know, in 
under. But, I don’t think that’s a reason not to do it. And I think 
it would be a mistake, actually, to say, “Well, because we can’t get 
it, you know, 100 percent, we should just give up.” 

Senator Pryor. Right. 

Mr. Szoka. 

Mr. Szoka. Senator, if I may respond, you are exactly right that 
there is no perfect method of age verification. But, there is another 
important distinction we have to understand, here. And it’s as sim- 
ple as the fact that when you sign up for a site, like Facebook, 
today you are indeed, as Marc has mentioned, required to provide 
your age. But, you can, indeed, Senator, as you have mentioned, 
simply lie. And the critical difference here is, that as it — as these 
sites function today, sites like Facebook and the many other sites — 
because this is not just about Facebook, but indeed about every site 
that potentially allows sharing and posting of comments, such as 
the blog that I run, for example — that when you sign up for those 
sites, you are not required to verify your age through the use of a 
credit card. This is the key issue. 

My point here is that, if we were to move to a world where 
COPPA applied to children under 18, you would have large num- 
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bers of sites that enable the sharing of — by users, of information 
about themselves — so-called user-generated content — to have to ac- 
tually age-verify. And that’s a fundamental difference from the cur- 
rent regime in which sites simply ask for age, and if you admit that 
you’re under a certain age, they block you, as they’re required to 
do. And it’s at that point that you start to run into precisely the 
same constitutional issues as were raised in COPA. Because COPA, 
in a nutshell, required certain sites to assume, again, that all their 
users might be children, and therefore require all users to verify 
themselves with a credit card, or similar tool. 

Senator Pryor. Dr. Montgomery, let me ask you about the state 
of academia on this. And that is, Are there studies out there, where 
people have really analyzed, maybe the child psychology or, how 
the industry really operates? I mean, is there a body of academic 
work on this that the Subcommittee can look at to, you know, get 
some insights on how things really work out there? 

Dr. Montgomery. Well, there’s a growing body of research about 
how young people are interacting with online social networks and 
other digital media; the MacArthur Foundation has funded a good 
deal of work in that area. None of it, I have to say, has really taken 
into account, or looked at, the commercial dimensions of the digital 
media. 

Senator Pryor. And privacy doesn’t 

Dr. Montgomery. Or the privacy. 

Senator Pryor. Yes. 

Dr. Montgomery. Now, there are some studies emerging on pri- 
vacy, but they’re not looking at the whole picture of digital mar- 
keting. 

I will say, also, that the experts in the food marketing area — and 
I’m working very closely with a number of them — because of the 
concerns about childhood obesity and the role of food marketing in 
that crisis, have begun to pay more attention to the digital market- 
place. And I’ve been doing a lot of research in that area and am 
working with experts who are looking at adolescent development 
and the role of adolescents in the digital marketplace, because 
they’re very much at risk for childhood obesity, and they’re not nec- 
essarily in a position to be asking their parents about their deci- 
sions about food. 

And we know that many of those food marketers are using be- 
havioral targeting and behavioral profiling to target, in interactive 
games and in other kinds of online settings, precisely those kids 
who may be most vulnerable to that kind of marketing. 

So, we are working with a number of people to conduct more re- 
search in that area. I’d be happy to supply the Committee with 
some of that research. 

Senator Pryor. Yes, I’d like to see that. 

And so, when you’re talking about, say, fast-food marketing, give 
me a scenario where that works. It sounds like, to me, that some 
kid may be walking down the street, and there’s a fast-food res- 
taurant, and he may get a message on his or her phone that they 
should go in there, they get a coupon or something. I mean, tell me 
how that works. 

Dr. Montgomery. That is where location marketing is going. 
And that is — you know, first of all, you know who the individual 
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consumer is. And as we’re finding, you know, it isn’t always nec- 
essary to even know the name. You simply know — need to know 
who that person is who is using that particular mobile phone, and, 
you know, what the age is, and the other demographic characteris- 
tics, as well as the behavioral characteristics — what kinds of sites 
they go to, and masses of amount of data that are being pulled to- 
gether by various tracking technologies. 

And, yes, the idea — and we’ve seen some trials with this, with 
some of the fast-food companies — would be, you know, that you’re — 
when you’re near that restaurant, you would get a coupon that 
could say, you know, “You can get a discount for this particular 
kind of product.” 

We’re also looking at interactive games and the kinds of behav- 
ioral profiling and targeting that’s going on there. So, let’s say 
you’re a pizza lover, you’re also addicted to interactive games, and 
interactive games online can then target you when you’re most, you 
know, aroused by the game and offer you pizza, and even provide 
you with direct access to an online site to order that pizza. And we 
know of — also, that we’re looking — a lot of apps on phones — I have 
an iPhone — that enable you to order things right away. So, it’s this 
kind of impulse buying. All of that is tied into behavioral targeting. 

Senator Pryor. And so, let me ask a follow-up there. You men- 
tioned the iPhone, which is an Apple product; so you have the man- 
ufacturer of the phone, but you also — what about the wireless com- 
panies? The cell phone companies themselves, the AT&Ts and 
Verizons of the world? Are they providing this type of information 
to marketers? I mean, are they giving age and things like that? Do 
we know that? 

Dr. Montgomery. It’s my 

Senator Pryor. Has anybody looked at that, that we know of? 

Dr. Montgomery. Yes, I mean, Marc, you may be able to answer 
that better, but they fall under a certain set of policies 

Senator Pryor. Right. 

Dr. Montgomery. — you know, that are — that apply to those com- 
panies, that are 

Senator Pryor. Right. 

Dr. Montgomery. — separate from what some of the online com- 
panies would. 

Do you want to answer that one? 

Senator Pryor. Do you know? 

Mr. Rotenberg. We’re not specifically aware of how the tele- 
phone companies collect the data on customers. But, there was a 
very interesting proposal to do a so-called “deep packet inspection” 
by Internet service providers which would actually reach much 
more deeply into the personal activity of people online, literally 
looking at all the e-mail traffic they were sending, and trying to 
take, you know, pointers to commercial activity out of that. 

I do want to make, just on this point, one further comment. I 
think Mr. Sparapani was correct when he said, earlier, that 
Facebook doesn’t disclose user data to advertisers. That’s right. 
But, Facebook does disclose user data to application developers so 
that when a Facebook user installs a Facebook app — you know, fa- 
vorite cities or snowball fight, or whatever it is — Facebook, at that 
point, is making a decision to send a lot of the user’s social graph 
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over to that company. And what they announced, just recently, is 
to do something very similar with third-party websites, like CNN 
and Pandora. 

So, it’s not the whole story, I think, at least in this situation, to 
say, in terms of Facebook, that the data doesn’t go to advertisers. 
There are other ways that the data is released. 

Senator Pryor. Thank you. 

And, Ms. Rich, I haven’t forgotten about you. 

Ms. Rich. I’m listening, here. 

[Laughter.] 

Senator Pryor. Let me ask you a few questions. First, did you 
have any follow-ups on any of this that you heard that you wanted 
to clarify? 

Ms. Rich. Well, I do have one follow-up from something Marc 
Rotenberg said, in his first statement, which is, I agree whole- 
heartedly that enforcement by the FTC, both of COPPA and gen- 
erally in privacy, is very important. And we are very proud of our 
enforcement record. Just in the last year, or even 6 months, we 
brought four data-security cases, which puts us at close to 30 data- 
security cases that we’ve brought. We’ve issued an Online Behav- 
ioral Advertising Report, and done at least one case involving de- 
ceptive tracking. We’ve done eight cases designed to promote the 
integrity of self-regulation. And I could go on and provide the — pro- 
vide you, Mr. Chairman, with more. But, I did want to comment 
on that. 

Senator Pryor. Yes. 

In your statement, you said — let me — I think I have this right — 
whether the rule’s definitions of “Internet” adequately encompasses 
certain technologies, like mobile communications. I don’t know if 
you remember that. And is the FTC looking at what we even mean 
by “Internet” today, and — the definition of “Internet” and “mobile 
technology”? I mean, are you reevaluating all of that, in light of the 
technological innovations? 

Ms. Rich. Yes, the — there was the standard definition that was 
very sci-fi-sounding, back — that they were using in all of the stat- 
utes when COPPA was passed, you know, “the World Wide, you 
know, Infrastructure,” and — you know, it’s a strange definition. 
And it’s not clear whether that encompasses just traditional online 
activities or whether it would extend to interactive activities that 
don’t actually go through the Internet. So, we’re very — looking at 
that very seriously. 

Senator Pryor. Knowing what you know now, in terms of the 
state of technology, but also what FTC has to deal with, with the 
statute, and looking at the statute, would you recommend that the 
Senate revisit some of those definitions in the underlying law right 
now? 

Ms. Rich. Well, we’re taking a hard look at that, and in a few 
months we’ll have the benefit of, hopefully, many, many comments 
on it. And at that point, we’ll figure out what our next move is, 
whether it’s something we can address, or not address, in the 
rule — meaning, we have the authority under the statute — or 
whether it’s something we’d have to come back to Congress on. 

Senator Pryor. OK. 
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You know, one of my staff guys, here, just gave me a little device 
that’s a Nintendo DS, which is interesting. I don’t know if it’s his 
or his child’s, but it has a Pokeman attached to it, so 

[Laughter.] 

Senator Pryor. Anyway, but it has a phone on it, and I don’t 
know if it plays music or exactly what. But, you know, obviously 
it’s a little game; it has a little game cartridge in there. But, it also, 
very easily and very quickly, allows the child to connect to the 
Internet. And, you know, it has the camera, you can do shopping 
and that type of thing. So, you know, this is a device that obviously 
didn’t exist, just a few years ago. And I guess I would encourage 
FTC, as you’re looking at this, to think through all the applications 
and — maybe not, you know, the — I think it’s probably hard to make 
a list of all of the devices, but just the functionality of it. If it’s con- 
necting to the Internet, and if it’s mobile and things like that — be- 
cause hopefully the electronics industry will continue to innovate, 
and will continue to do great things, and bring things on the mar- 
ket, and, you know, hopefully when the FTC goes through your 
process, you’ll define things in such a way, and you’ll work with us 
to define things in such a way, that when new products like this 
come onto the market, you know, the statute captures that and we 
don’t get out of date. 

I 

Ms. Rich. Can I just say 

Senator Pryor. Yes, please. 

Ms. Rich. — that we have two of those in our house; one for my 
12-year-old and one for my 9-year-old, and they 

Senator Pryor. So, they’re 

Ms. Rich. — talk to each other. And when it does access the Inter- 
net, I think we would be safe to say that’s covered, because it’s ac- 
cessing the Internet. 

Senator Pryor. Right. 

Ms. Rich. But the question is, if they’re just speaking to each 
other, and not through the Internet — there’s functionality that just 
can go, you know, machine to machine. 

Senator Pryor. Right. 

Ms. Rich. Is that covered? 

Senator Pryor. Right. 

Well, it is just an example of things that I know the Federal 
Trade Commission has to think through. 

I could, actually, spend a lot more time asking questions, because 
this is very interesting. And I know that we’ve had — our members 
here had to move on to either speaking on the floor or other com- 
mittee meetings they had to get to. 

So, let me just do this, at this point, let me just ask the panel 
if there’s anything anyone would like to say before we close down 
the hearing, because we’ve had a little bit of back-and-forth, and 
I just wanted to give everybody a chance to respond or to make one 
last final point. 

So, is there anybody that wants to add anything? 

Mr. Rotenberg. Very briefly, Mr. Chairman, I just wanted to 
thank you for holding this hearing. I mean, I think there are a lot 
of people who appreciate COPPA and believe it plays an important 
role in safeguarding online privacy, but also feel that, given new 
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technologies and new business practices, something more probably 
needs to be done. So, this is a very good place to start that discus- 
sion. 

Senator Pryor. Thank you. 

Mr. Szoka. Sir, if I may say, just briefly, I wanted to stress in 
my testimony that COPPA is device-neutral. And that’s one of the 
great things about the statute. The example you gave, I think, Ms. 
Rich, is exactly right, here. We may not need changes to the stat- 
ute, the FTC will look at that, but I think that the FTC probably 
has the flexibility to apply “the Internet” very broadly to all of 
those services that touch upon, and are integrated into, the Inter- 
net. 

So, again, I want to stress, here, my concerns are not with the 
FTC updating the rules consistent with the statute, but simply 
about making broad changes to the statute that have greater con- 
sequences for speech. 

Senator Pryor. OK, thank you. 

Yes, ma’am. 

Dr. Montgomery. Yes, I again thank the Committee for holding 
this hearing. It’s very heartening for me to hear, having struggled 
with many others in the 1990s to get this law passed, that it has 
been a success. And I’m very pleased about that, and I’m very 
pleased to be working with the FTC to ensure that COPPA is able 
to address the continuing rapid changes in the digital marketplace. 

But, again, I would just like to make a plea that we, as a society, 
and that the government and the industry, not ignore the needs of 
the Nation’s teenagers. 

Senator Pryor. Right. 

Mr. Hintze. I’d, again, like to thank you for holding this hearing 
today, and the members of the Committee for participating. 

A lot of discussion today around kids, and a lot of discussion 
today around teens and the ages not covered, currently, by COPPA. 
I think our position, and a number of the other panelists, is that 
COPPA may not be the right vehicle to address the teen issues. 
The issues that teens face online are somewhat different from those 
that younger children face, the types of sites they use are quite dif- 
ferent, in many cases. But, others have expressed the need for 
some legal protections of teens, and we agree. And so, we would en- 
courage the Committee to continue to look at the privacy issue 
more generally, maybe not in the framework of COPPA, but look- 
ing at privacy legislation, at the Federal level, that would address 
privacy protections for not only teens, but adults, as well. 

Senator Pryor. Good. 

Yes, sir. 

Mr. Sparapani. What’s new from our perspective, since the dawn 
of COPPA, is that we’re entering a moment, I think, in the Infor- 
mation Age, for the first time, when we actually have the oppor- 
tunity for technology to reinstill privacy into people’s online lives 
through new tools. And there’s this sort of user-control model that 
Facebook and a number of our — companies like us are trying to put 
forward, is a really new thing, and it actually holds real promise 
for user privacy. 

What’s more difficult is getting users to understand the new tools 
and use them in a wise manner, and to, frankly, find them and ex- 
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ercise them. And it’s especially hard with teenagers. So, that’s 
someplace there where I think we’re going to spend some energy. 

But, again, thank you, Senator, for holding this hearing. 

Senator Pryor. Thank you. 

Ms. Rich. And I’ll echo the thanks to you, Mr. Chairman, and 
to the other panelists, for engaging on these important issues. 

And also say that we should have a lot more to report after our 
comment period closes and after we have our workshop in June. So, 
I look forward to talking some more. 

Senator Pryor. Thank you, Ms. Rich. 

Let me ask the FTC one last question, and that is, As part of 
your evaluation are you also looking at your manpower, slash, re- 
sources there at the Commission? I mean, some of the witnesses 
have said that if you had more resources, you could do more en- 
forcement and be more effective in enforcing COPPA. Are you all 
evaluating that, as well? 

Ms. Rich. Yes, we are. 

Senator Pryor. And will you come back to the Senate with a rec- 
ommendation on that? 

Ms. Rich. Sure. 

Senator Pryor. OK. Thank you very much. 

[Laughter.] 

Senator Pryor. And I guess, in closing, I’d like to say, we’re 
going to leave the record open for 2 weeks. So, don’t be surprised 
if some of the Senators or the staff here want to submit some more 
questions, because there are some I didn’t go into because I’ve 
taken too much of your time already. But, we’ll probably submit 
some of these over the next couple of weeks. We would ask you to 
get those back as quickly as you can, and always work with our 
staff. 

But, in closing, I’d like to say, this may be one of those areas 
that I think that Senator Wicker kind of alluded to earlier. There’s 
an old Abraham Lincoln quote that says, “Government should do 
for people what people can’t do for themselves.” And this is an area 
where we want people participating in the marketplace, and using 
this technology, and enhancing their lives, and doing all of these 
great things. But, we just have to make sure that that marketplace 
is secure, that the right privacy parameters are there, the right 
legal structure is there, we have the right enforcement. I mean, we 
just have to make sure that that marketplace is working, because 
the people can’t do this for themselves. I think there’s a level of 
government, and certainly private sector, the private industry has 
a lot of good actors in it, but there are some bad actors, as well. 
So, we’re trying to find that balance. 

But, anyway, thank you all for your participation today. I know 
Chairman Rockefeller appreciates it, and I do, too, and all the Sub- 
committee. 

So, thank you very much. 

And, with that, we’ll adjourn the meeting. 

Thank you. 

[Whereupon, at 11:52 a.m., the hearing was adjourned.] 




APPENDIX 


Response to Written Questions Submitted by Hon. Mark Pryor to 

Jessica Rich 

Question 1. Do you think the age limit in COPPA is appropriate? And if so, why? 

Answer. After looking closely at whether adolescents should be covered for pur- 
poses of the COPPA statute, Congress chose to define a “child” as an individual 
under age 13. This choice was based in part on the sense that most young children 
do not possess the level of knowledge or judgment to determine whether to divulge 
personal information over the Internet. The FTC supported this assessment at the 
time the COPPA statute was introduced.* The staff anticipates it will receive com- 
ments on this issue during the FTC’s COPPA Rule review. 

Question 2. Do you think COPPA should be strengthened? 

Answer. The FTC currently is reviewing the COPPA Rule in its entirety in light 
of significant changes in the online environment, including the rise of social net- 
working and the proliferation of interactive technologies, and the increasing use of 
the mobile web and interactive gaming. Through the FTC’s March 2010 request for 
written public comment, as well as its June 2 roundtable, the agency intends to ex- 
plore what’s working optimally, and where changes might be warranted. Once we 
have completed the public roundtable and the comment period has closed, the Com- 
mission will carefully evaluate whether any modifications to the Rule are war- 
ranted. 

Question 3. Should the FTC reexamine what constitutes “personal information” in 
its review of COPPA? Or do you believe that the online space and the definition of 
personal information should remain the same as it was when the law was created 
over 10 years ago? 

Answer. The FTC is reexamining whether the Rule’s current definition of “per- 
sonal information” needs to be revised, consistent with the COPPA statute (i.e., per- 
mitting the physical or online contacting of a specific individual), to include, for ex- 
ample, other types of information such as user or screen names and/or passwords, 
zip code, date of birth, gender, persistent IP addresses, mobile geo-location informa- 
tion, or information collected in connection with online behavioral advertising. The 
FTC has asked for written comments on this issue and the FTC staff has dedicated 
a panel at the June 2 COPPA roundtable to the question (see agenda, at http:l / 

www.ftc.gov / bcp I workshops / coppa I Agenda 2010COPPARoundtable.pdf). At this 

time, it would be premature to conclude whether the FTC is likely to amend the 
Rule’s current definition of personal information. 

Question 4. In your opinion, what is the biggest threat to children’s privacy and 
safety in today’s online world? 

Answer. For many young people, socializing and communicating online can be a 
rewarding experience, but those activities come with risks, including: 

• Inappropriate conduct, including online harassment, cyberbullying, and sexting. 
The online world can feel anonymous. Young people sometime forget that they 
are still accountable for their actions and do not realize that they may lose the 
ability to control the dissemination of information and photos once they are 
shared online. 

• Inappropriate contact. Some people online have bad intentions, including bul- 
lies, predators, hackers, and scammers. 

• Inappropriate content. Young people may find pornography, violence, or hate 
speech online. 


* See September 23, 1998 Testimony of the Federal Trade Commission before the Sub- 
committee on Communications, Senate Committee on Commerce, Science, and Transportation, 
available at http:/ / www.ftc.gov I os 1 1998 1 09 / priva998.htm. 
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It is difficult to determine what the “biggest threat” might be, because every child 
has unique circumstances that affect his or her personal risk profile. The FTC is 
closely following research conducted by the Pew Internet & American Life Project 
and the Crimes Against Children Research Center, among others, so that we may 
better understand the interplay between children’s experiences and the risks they 
face online. Such research helps us craft useful advice for parents and children, such 
as the advice for parents in our recent publication, Net Cetera: Chatting with Kids 
About Being Online. 

Question 5. What do you think is the most urgent update to COPPA needed? 

Answer. As stated above, the FTC currently is reviewing the COPPA Rule in its 
entirety. Through the FTC’s Rule review process, the agency intends to take a care- 
ful and comprehensive look at the Rule, with input from many sources. The agency 
is keeping an open mind, therefore, on what the most pressing modifications, if any, 
might be to the Commission’s Rule or to the underlying statute. 

Question 6. In your opinion, what would constitute the most appropriate definition 
of “sensitive data” in the context of children’s online privacy? 

Answer. The COPPA statute does not define or use the term “sensitive data.” 
However, the statute does contain an enumeration of what type of individually iden- 
tifiable information is considered to be “personal,” the collection of which requires 
an operator to obtain prior verifiable parental consent. “Personal information” is de- 
fined as: 

individually identifiable information about an individual collected online, in- 
cluding — (A) a first and last name; (B) a home or other physical address includ- 
ing street name and name of a city or town; (C) an e-mail address; (D) a tele- 
phone number; (E) a Social Security number; (F) any other identifier that the 
Commission determines permits the physical or online contacting of a specific 
individual; or (G) information concerning the child or the parents of that child 
that the website collects online from the child and combines with an identifier 
described in this paragraph. 

In promulgating the COPPA Rule in 1999, the FTC used the open-ended authority 
granted under subpart F of the definition of personal information to add “other on- 
line contact information, including but not limited to an instant messaging user 
identifier, or a screen name that reveals an individual’s e-mail address.” The Com- 
mission also added to the definition “a persistent identifier, such as a customer 
number held in a cookie or a processor serial number, where such identifier is asso- 
ciated with individually identifiable information; or a combination of a last name 
or photograph of the individual with other information such that the combination 
permits physical or online contacting.” Since promulgating the COPPA Rule, the 
FTC has not further expanded upon the definition of personal information. However, 
as noted in our response to the previous question, the FTC is reexamining the defi- 
nition of “personal information” as part of its overall Rule review. 

Question 7. You mentioned major tenets of children’s privacy the FTC will con- 
sider in its reexamination of the effectiveness of COPPA. Specifically, you address 
“whether the Rule’s definition of ‘Internet’ adequately encompasses [certain] tech- 
nologies” like mobile communications. Will the FTC consider in its review the im- 
pact of data and location tracking devices, such as GPS systems, on children’s safe- 
ty? 

Answer. Yes. The FTC’s March 2010 request for public comment seeks input on 
whether the Rule’s current definition of personal information needs to be revised, 
consistent with the COPPA statute (i.e., permitting the physical or online contacting 
of a specific individual), to include mobile geo-location information, among other 
things. 

Question 8. How does the Commission enforce whether operators have “actual 
knowledge” that their sites are used by children under 13? Is this scienter require- 
ment an issue that merits additional scrutiny in your opinion? 

Answer. As explained in the Statement of Basis and Purpose accompanying the 
COPPA Rule, actual knowledge will be present where the operator obtains direct 
information about a child’s age or grade, for example, from a child’s registration at 
a website or from a concerned parent who has learned that the child is participating 
at the site. In addition, the FTC has explained that it will examine closely websites 
that do not directly ask age or grade, but instead ask “age identifying” questions, 
such as “what type of school do you go to: (a) elementary; (b) middle); (c) high 
school; (d) college” and that through such questions, operators may acquire actual 
knowledge that they are dealing with a child under age 13. 

The FTC has stated that the COPPA statute’s actual knowledge standard does not 
require operators of general audience sites to investigate the ages of their website’s 
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visitors or to monitor their chat rooms. However, an operator may be considered to 
have actual knowledge with respect to a specific child if someone from the operator’s 
organization views a revealing post, or if someone alerts the operator to such a post 
(e.g., a concerned parent who learns that his child is participating on the site). 

Thus far, all of the FTC’s COPPA cases involving “actual knowledge” center on 
an operator’s direct receipt of information about a child’s age input during the reg- 
istration process. 

The FTC staff has dedicated a panel at its June 2 COPPA roundtable to exploring 
the COPPA statute’s actual knowledge standard. 

Question 9. Are there any restrictions on state AGs enforcing compliance with the 
COPPA rule? 

Answer. The COPPA statute permits state attorneys general to file civil actions 
on behalf of their residents in U.S. District Court to enjoin an operator’s practices, 
enforce compliance with the FTC’s COPPA Rule, obtain damages, restitution, or 
other compensation on behalf of their residents, or to obtain such other relief as the 
court deems appropriate. The statute places several minor limitations on a state at- 
torney general’s right to enforce COPPA. First, unless it would be infeasible to do 
so, an attorney general intending to enforce COPPA must provide the FTC with 
written notice and a copy of the complaint prior to filing the state action. Upon re- 
ceipt of notice of a state’s intent to enforce COPPA, the FTC has the right to inter- 
vene, to be heard, and to file a petition for appeal in the action. The statute also 
provides that any person or organization that has been approved by the FTC as a 
COPPA safe harbor program and whose guidelines are relied upon by a defendant 
as a defense may file as amicus curiae in a state COPPA proceeding. 

To date, only one state — Texas — has provided notice to the FTC of its intention 
to enforce COPPA. In December 2007, Texas filed two COPPA actions, one against 
The Doll Palace Corp., and the other against Future US, Inc. (a/k/a 
gamesradar.com). Information about the Texas actions can be found at http:/ / 
www. oag. state, tx. us / oagNews / release. php ?id=2288. 

Question 10. How is the Net Cetera distribution and education campaign working? 
Have the materials and the FTC’s efforts to reach out to teachers and parents been 
effective? 

Answer. The FTC issued a report to Congress about the Net Cetera campaign in 
March 2010, available at http://www.ftc.gov/osl2010/03/100331netcetera-rpt.pdf. 
This report discusses the creation of Net Cetera, how the FTC is getting the word 
out about the guide, and distribution highlights. 

The Net Cetera education campaign continues to be a success. Since October 2009, 
the FTC has received orders for the Net Cetera guide from every state in the nation, 
for a total of over 3 million copies ordered in English and Spanish. Other outreach 
highlights include: 

• Prince George’s County Public Schools — the 2nd largest school district in Mary- 
land and 18th largest in the Nation — distributed approximately 150,000 copies 
of Net Cetera. 

• Public and school libraries across Massachusetts have received copies of the 
guide and are now placing orders, and every member of the Young Adult Li- 
brary Services Association (YALSA) has received a copy. 

• The National Association of School Nurses will distribute the guide to attendees 
at their upcoming annual conference. 

• FTC staff are attending and speaking at conferences this summer to promote 
Net Cetera, including tbe widely-attended International Society for Technology 
in Education Annual Conference and the National School Public Relations Asso- 
ciation National Seminar. 

• Schools, police departments, and organizations in Arkansas have ordered over 
34,000 copies of the guide. 

Question 11. You mention 14 cases brought by the Commission over the past 10 
years alleging COPPA violations. From your perspective, have those cases served to 
deter repeat violations or additional COPPA violations? 

Answer. The FTC has been strategic in bringing cases that illustrate different 
core requirements. We have garnered widespread interest and significant leverage 
from each COPPA enforcement action addressing a particular type of violation. Tbe 
FTC’s early COPPA enforcement actions focused on children’s sites that collected ex- 
tensive amounts of personal information without providing notice to parents and ob- 
taining their consent. Most recently, the FTC has focused on operators of both gen- 
eral audience and child-directed social networking sites and sites with interactive 
features that permit children to publicly divulge their personal information online. 
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Although law enforcement is a critical part of the Commission’s COPPA program, 
the FTC’s COPPA program is comprised of several effective integrated compo- 
nents — rulemaking, self-regulation, routine outreach to businesses and consumers, 
and law enforcement — that work in tandem to enhance overall COPPA compliance. 
The FTC believes that this integrated approach has served to deter repeat or addi- 
tional violations. 

Question 12. What should the FTC or Congress do to strengthen children’s safety 
and privacy online in conjunction with advanced technologies and mobile devices? 

Answer. The COPPA statute applies to operators of commercial “websites located 
on the Internet” and “online services” that collect, maintain or disclose children’s 
personal information on the Internet. Where children connect to websites or online 
services through mobile devices, the statute clearly applies. Where children are not 
connecting to or through websites or online services, COPPA may not apply. Thus, 
many, but not all, mobile communications may be covered by the statute. The FTC’s 
Rule review will examine how the definitions of Internet, websites, and online serv- 
ices may affect COPPA’s application to different mobile and other technological uses. 

Question 13. [Do you agree with the direction the FTC is taking as it reexamines 
the implementation and effectiveness of COPPA?] 

Answer. N/A 

Question 14. How do you propose to improve parental supervision and control of 
children’s online activity to prevent the inappropriate or illegal collection and use 
of their information? 

Answer. The FTC will continue to focus on educating parents, through tools such 
as Net Cetera and the agency’s online safety portal, OnGuardOnline.gov, about the 
rights and protections provided by COPPA, and about children’s online privacy and 
safety more generally. 

Question 15. If you support a regime granting rules of the road for adolescents’ 
privacy, how do you envision this sort of regime working? How would you propose 
it be structured? If you do not support a regime governing adolescents’ privacy, 
please explain your reasoning. 

Answer. The FTC’s current review is focused on the COPPA Rule, and on the on- 
line privacy of individuals defined as children under that statute. The FTC has not 
yet had the opportunity to formulate an opinion on a possible regime to protect ado- 
lescents’ privacy. The agency looks forward, however, to reviewing any proposals 
that may be put forward. In addition, last year, the agency released a set of prin- 
ciples relating to online behavioral advertising. Moreover, the Commission currently 
is examining privacy more broadly and hopes to develop a general privacy frame- 
work in the coming months. 


Response to Written Questions Submitted by Hon. Mark Pryor to 
Timothy Sparapani 

Question 1. What steps is Facebook taking to promote the advancement of chil- 
dren’s privacy? 

Answer. Facebook provides users with innovative privacy controls to give users 
control of their information online. We have recently provided users with additional 
steps for controlling sharing both on Facebook and with third parties such as other 
websites or applications. 

Facebook takes additional steps specifically targeted to minors. For example, we 
provide specialized privacy settings so that minors may further control their sharing 
through Facebook. In part, this eliminates the potential of minors sharing with ev- 
eryone. Even minors who want to share with the maximum number of people may 
only share with users under 18 years of age. Additionally, Facebook provides special 
educational materials for minors. Furthermore, Facebook imposes rules requiring 
Facebook Pages and applications built by third parties on Facebook to impose age 
“gates” that work to prevent minors from accessing content that is inappropriate for 
their age or to be accessed through these Pages or Applications by non-minors. 

Question 2. Do you think the age limit in COPPA is appropriate? And if so, why? 

Answer. Facebook takes no position on the age limitations imposed by COPPA. 
We are not experts on the appropriate age to set for online activity, but our experi- 
ence informs us that teenagers 13 years of age generally act in a responsible man- 
ner on Facebook. 

Question 3. Do you think COPPA should be strengthened? 

Answer. COPPA could be strengthened by providing incentives for companies to 
innovate without fear of liability to develop new technologies. The current legislative 
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and regulatory structure should encourage, not discourage continuing technological 
innovation. 

Question 4. Should the FTC reexamine what constitutes “personal information” in 
its review of COPPA? Or do you believe that the online space and the definition of 
personal information should remain the same as it was when the law was created 
over 10 years ago? 

Answer. At this time, Facebook is not recommending an amendment to the defini- 
tion of “personal information.” 

Question 5. In your opinion, what is the biggest threat to children’s privacy and 
safety in today’s online world? 

Answer. The U.S. Congress has failed to appropriate sufficient funds to ensure 
that the KIDS Act of 2008 actually is fully implemented. In particular, the KIDS 
Act requires the creation of a Federal list of Registered Sex Offenders (RSOs) but 
that list has not been completed. Because of this, Facebook prepares its own list — 
at Facebook’s own expense — to help us periodically review our list of users and ter- 
minate accounts that might have been established by RSOs. Smaller companies, 
particularly application developers, do not have such resources and are unlikely to 
expend scarce resources to obtain a list of RSOs from all 50 states. Congress should 
encourage the F ederal Government to build and maintain an up-to-date list of RSOs 
and distribute it to any company that asks for the list. 

Furthermore, the U.S. Government should negotiate with foreign governments to 
obtain lists of those countries’ RSOs to further support responsible companies’ at- 
tempts to prevent access by RSOs to online services where minors may be present. 

Question 6. What do you think is the most urgent update to COPPA needed? 

Answer. Congress should explicitly create a safe harbor expressly permitting com- 
panies to explore technological and policy innovations to further limit the access of 
minors to sites that are inappropriate for their age, and to do so without fear of 
regulatory or legislative sanction. The current model discourages innovations that 
could advance the privacy, safety, and security of minors. 

Question 7. In your opinion, what would constitute the most appropriate definition 
of “sensitive data” in the context of children’s online privacy? 

Answer. Facebook does not categorize data as sensitive. Rather, all information 
is treated as sensitive and subject to disclosure subject to a user’s privacy settings 
and only at the user’s direction. Because we recognize that minors are special, we 
explicitly prohibit minors from sharing with groups of individuals wider than the 
classification of Friends of Friends and Networks, where minors’ Networks are typi- 
cally their classmates at their schools. 

Question 8. Recent press reports have indicated that Facebook is making available 
to the Web user information that has been previously contained within closed net- 
works. Which pieces of user information are or will be made publicly available with- 
out the user proactively making any changes to her privacy policy? 

Answer. Contrary to press reports, Facebook does not make available to third par- 
ties information that was previously contained within closed networks. In December 
of 2009, Facebook eliminated Regional Networks that were established when 
Facebook’s user base was much smaller. These Regional Networks provided any 
members of a particular network the opportunity to view content of any other par- 
ticipants. By eliminating these Regional Networks, Facebook enhanced minors’ pri- 
vacy substantially. 

Further, in part to respond to this misinformation contained in press reports, 
Facebook recently provided our users with a single “global opt out” option to elimi- 
nate even any voluntary sharing with third parties. 

Question 9. How does Facebook verify or authenticate its users’ identities or ages? 

Answer. As explained at length in our written and oral testimony, no company 
can actually “verify” any users’ age. Instead, Facebook uses a series of novel, propri- 
etary technologies to draw assumptions about the likelihood that a user is of age. 
Moreover, our users are required to provide us with their ages at the moment they 
create an account. 

Question 10. Is Facebook tied or affiliated in any way with location-based adver- 
tising? Is it possible for a 14-year-old Facebook user to be tracked by other compa- 
nies, devices or data gatherers without her knowledge or consent? 

Answer. Facebook provides ads targeted to users based on their hometown. We 
never provide this piece of information to advertisers. To our knowledge, it is not 
possible for other companies, devices or data gatherers to track Facebook users 
using the users’ Facebook information wither any users knowledge or consent. 

Question 11. Could you describe your company’s efforts to educate parents and 
teachers about online safety? 
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Answer. Since our inception, Facebook has worked assiduously to educate parents 
and teachers about online safety. Just last week, we were awarded an award from 
Wired Kids that we received, in part, due to our ongoing efforts to educate our 
users. Our staff speaks at an extraordinary number of events per year that are in- 
tended to perform this function. Our Safety and Privacy pages provide full expla- 
nations of how our users may fully utilize our innovative privacy settings and has 
been recently revised to offer specific sections with content tailored to different audi- 
ences, including parents, educators and teens. 

Question 12. How do you work with law enforcement to combat Internet crime? 

Answer. Our Chief Security Officer and the team he supervises work closely with 
governments throughout the U.S. and around the world to comply with lawful re- 
quests for assistance. Recently, Facebook provided the key information that helped 
secure the two largest CAN-SPAM Act judgments in history, leading to a substan- 
tial reduction in the amount of spam messaging our users are subjected to. On the 
rare occasion that Facebook identifies illegal material being circulated through our 
site we prevent the disbursement of that information and then report the content 
and the user account attempting to distribute that material to the National Center 
on Missing and Exploited Children and appropriate law enforcement. We would be 
happy to brief the Subcommittee at length about other assistance provided, within 
the scope of the law, to law enforcement. 

Question 13. What should the FTC or Congress do to strengthen children’s safety 
and privacy online in conjunction with advanced technologies and mobile devices? 

Answer. In addition to fully implementing the KIDS Act, the FTC should nego- 
tiate with foreign governments to encourage the sharing of foreign governments’ 
RSOs with the U.S. Government and U.S. companies. 

Question 14. Do you agree with the direction the FTC is taking as it reexamines 
the implementation and effectiveness of COPPA? 

Answer. F acebook supports the second five-year review of COPPA. 

Question 15. How do you propose to improve parental supervision and control of 
children’s online activity to prevent the inappropriate or illegal collection and use 
of their information? 

Answer. We recommend that parents insist on being made friends on Facebook 
of their children, or, alternatively, that another adult friend or family member be 
made a friend of teenage users. Further, as mentioned previously, we have recently 
created additional educational materials targeted to parents to help them become 
more conversant with Facebook and tools to help safeguard minors’ information. 

Question 16. If you support a regime granting rules of the road for adolescents’ 
privacy, how do you envision this sort of regime working? How would you propose 
it be structured? If you do not support a regime governing adolescents’ privacy, 
please explain your reasoning. 

Answer. Facebook prohibits users less than 13 years of age from using our service. 
We limit minors’ sharing to reduce the scope of that sharing. Further, we give our 
users privacy controls to control virtually all of their information online. Any modi- 
fication to COPPA or the regulations implementing it should recognize effective re- 
gimes such as that created by Facebook. 


Response to Written Questions Submitted by Hon. Mark Pryor to 
Michael D. Hintze 

Question 1. What percentage of your parental users take advantage of the paren- 
tal controls offered by your software and services? 

Answer. Although we know for the sites and services where we ask for age wheth- 
er a user is under 13, we are unable to determine how many of our total users are 
parents. While reliable data specific to Microsoft’s products and services is not avail- 
able, research by the Henry J. Kaiser Family Foundation found that 41 percent of 
parents report using parental controls to block their children’s access to some 
websites. 1 

Question 2. You said in your written statement that “Microsoft proactively re- 
quests age information and seeks parental consent for children’s use of many of its 
services even when those services are not specifically targeted to children.” What 
formula do you use to determine whether to seek parental consent for children’s use 
of services that are not specifically targeted to children? (How do you make that de- 
termination and could you give the Committee some examples of those services?) 


1 Henry J. Kaiser Family Foundation, Parents, Children & Media, at 11 (June 2007), http: 1 1 
www.kff.org i entmedia / upload / 7638.pdf. 
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Answer. Our approach goes beyond COPPA in that we screen for age and obtain 
parental consent for under-13 users not only on our sites and services that are “tar- 
geted” to children, but also on our general audience sites that are “attractive” to 
children. 2 We do not have an exact formula for determining which sites or services 
may be attractive to children, but some examples of general audience services where 
we have decided to screen for age and seek parental consent for users under 13 in- 
clude Hotmail, Messenger, Windows Live Spaces and Xbox Live. 

Question 3. Do you think the age limit in COPPA is appropriate? And if so, why? 

Answer. Yes, we believe the age limit in COPPA is appropriate. It is certainly 
true that COPPA’s stated goals of increasing parental involvement and protecting 
privacy are important with respect to teenagers. But COPPA’s existing structure 
and parental consent processes are not well suited to deal with this age group. For 
example, teens are too sophisticated to be deterred by age gates, and existing paren- 
tal consent mechanisms — such as the toll-free number and print and send meth- 
ods — may not be reliable in ensuring it is the parent rather than the teen who is 
giving consent. 

In addition, teens’ use of the Internet raises somewhat different privacy and safe- 
ty issues than for children under thirteen. For example, while older teens may be 
more likely to understand the implications of online advertising than young chil- 
dren, teenagers may be more likely to be faced with instances of cyberbullying on- 
line. 3 

We believe there are alternative ways to protect the privacy of teens online that 
are better than simply expanding COPPA’s age limit. For instance, Microsoft pro- 
vides parents with a number of educational resources and technology tools so that 
they can talk to their teens about the importance of privacy and safety online and 
be more involved in their online activities. Additionally, Microsoft has long sup- 
ported comprehensive Federal privacy legislation that would establish baseline pro- 
tections and enhance the privacy of all individuals — including teens. 4 We are com- 
mitted to working with Congress to advance these important efforts. 

Question 4. Do you think COPPA should be strengthened? 

Answer. We do not believe that amending the statute is necessary at this time. 
The statute provides the FTC with sufficient authority and flexibility to address 
children’s privacy issues in light of evolving technologies and business models. We 
commend the Commission for launching its review of the COPPA Rule, which had 
been planned for 2015, 5 years early in order to account for new technologies. At 
the very least, we believe it would be prudent to allow the FTC to complete its Rule 
review before determining whether legislative action is necessary. 

Question 5. Should the FTC reexamine what constitutes “personal information” in 
its review of COPPA? Or do you believe that the online space and the definition of 
personal information should remain the same as it was when the law was created 
over 10 years ago? 

Answer. Yes, the FTC should reexamine the definition of “personal information,” 
and we are pleased that they have indicated an intent to do so. With its flexible 
definition of personal information, the COPPA statute is sufficiently forward-looking 
and gives the FTC the rulemaking authority to address evolving circumstances and 
needs. Therefore, we believe that the FTC, within the parameters of the existing 
statute, can update the definition of “personal information” included in the COPPA 
Rule to address the wide range of factors that have changed over the last decade. 

Question 6. In your opinion, what is the biggest threat to children’s privacy and 
safety in today’s online world? 

Answer. Criminals who prey on children and families are the biggest threat to 
children’s privacy and safety. To help thwart these criminals, Microsoft works with 
lawmakers in many countries to promote stronger online safety and privacy legisla- 
tion and Internet safety education in schools. We help train law enforcement per- 
sonnel in using technology to help combat online child pornography, child predators, 
and child exploitation. We use a filtering tool to review images uploaded to Windows 
Live Spaces and other Microsoft online properties to detect potential instances of 
child exploitation. And we are working with law enforcement officials in several 


2 See Microsoft Corp., Privacy Guidelines for Developing Software Products and Services, Sec- 
tion 1.11 and Scenario 8, available at http : / / download.microsoft.com / download 7 0 / 8 12 / 082448 

D8-2AED-45BC-A9A0-094840E9E3A2 / Microsoft and%20Privacy guidelines for developers 

.doc. 

3 See Amanda Lenhart, Pew Internet & American Life Project, “Cyberbullying 2010: What the 

Research Tells Us” (May 6, 2010), http : / / www.pewinternet.org / -/ media/ /Files / Presentations / 
NCMEC Cyberbullying%20talk%20050610release.ppt. 

4 See, e.g.. http : / / www. microsoft.com/presspass / features / 2005 / nov05 111 -03Privacy. mspx. 
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countries to deploy the Child Exploitation Tracking System (“CETS”), a software 
tool to help investigators share and analyze information for tracking child exploi- 
tation on the Internet. We are committed to working with Congress, Federal and 
state agencies, nonprofit organizations, and other industry leaders to help protect 
children’s privacy and safety in today’s online world. 

Question 7. What do you think is the most urgent update to COPPA needed? 

Answer. We do not believe that the COPPA statute needs to be updated at this 
time. As explained in my testimony, we believe that the best course is for the FTC 
to update the COPPA Rule by providing clear guidance on how companies can better 
meet both the letter and the spirit of the law in light of changing technologies and 
by addressing the weaknesses of the currently approved approaches to obtaining 
verifiable parental consent. 

Question 8. In your opinion, what would constitute the most appropriate definition 
of “sensitive data” in the context of children’s online privacy? 

Answer. Under COPPA, any personal information collected from children under 
the age of 13 triggers the obligations of the Act, including the requirements for 
verifiable parental consent. We believe this broad approach is appropriate given the 
unique sensitivities involved with the collection and disclosure of data from young 
children. 

Question 9. How does Microsoft handle location information? And what is the com- 
pany’s relationship with location tracking applications? 

Answer. Microsoft is a leader in developing privacy standards to protect users of 
location-based services. In 2004, Microsoft partnered with TRUSTe and AT&T Wire- 
less to form the Wireless Advisory Committee, which works with companies pro- 
viding wireless data and wireless web services to ensure that specific standards re- 
garding consumer notice and consumer consent are achieved. 5 

We expect to offer some location-based services on our platforms in the upcoming 
months. These location-based services may include local search, camera, mapping, 
and phone finder applications and services that utilize a user’s current location. 

Microsoft is committed to providing users control over their location-based data. 
On our platforms, users must first agree to allow Microsoft to access or use their 
current location, and users can always disable the sending of location information 
if they change their minds. Microsoft does not currently offer any services that dis- 
close a user’s location to others or that allow users to be tracked by third parties. 

Question 10. You mention a “digital identity card” as one technology that could 
enhance authentication and streamline parental consent processes? Could you elabo- 
rate upon your idea? 

Answer. Over time robust digital identity cards may become analogous to tangible 
cards in a person’s wallet. In much the same way that a person might use a student 
ID card to get free admission to a museum, one or more digital identity cards may 
be used to verify the card owner’s identity or an identity attribute, such as age or 
parental status. 

To accomplish these types of verification, one way that digital identity cards could 
be issued is through offline processes where approved verification of a parent-child 
relationship already occurs. Website operators and online service providers could 
verify age and obtain parental consent by requesting that parents and children pro- 
vide their digital identity cards before a child may access interactive services and 
features. These types of technologies still require that robust proofing and authen- 
tication processes occur, but can facilitate the online use and reuse of the proofing. 
Like with other solutions, they are not foolproof and should be used in conjunction 
with education and other online safety tools, including technologies that help bal- 
ance against the disclosure of information that is not needed to verify the identity 
of the child or the parent. 

Question 11. Does Microsoft have any other ideas for new parental control meth- 
ods that would not cause additional privacy concerns or be tied to an IP address? 

Answer. Microsoft recommends that the FTC expand its list of approved parental 
consent methods to include other reliable approaches that minimize burdens on par- 
ents, leverage existing technologies, and scale for millions of users. Because children 
are increasingly using mobile phones and other mobile devices, we also urge the 
FTC to consider the types of parental consent mechanisms that are appropriate for 
online services that are accessed through these devices. 


5 TRUSTe, “TRUSTe Announces First Wireless Privacy Standards to Protect Mobile Users” 

(Feb. 18, 2004), http : / lwww.truste.com / about TRUSTe / press-room j news truste announces 

first wireless privacy standards.html. 
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Microsoft is working on technology that enables parents and children to better 
manage their identities online in a privacy enhancing way. When combined with the 
use of digital identity cards, these technologies could allow parents and children to 
disclose only that information that is necessary (such as parental status or age, but 
not name or other personal information) to enable children’s access to and use of 
websites and online services. 

Question 12. In your “Family Safety at Microsoft” attachment submitted to the 
Committee, you state, “In the United States, 71 percent of teens with online access 
have a social networking profile.” What are the implications of this statistic for our 
discussion? Are children using common sense when using the Internet? Do trends 
indicate that young children are disclosing information they shouldn’t and what are 
companies doing with that information? 

Answer. Given the percentage of teens that are using social networks, it is impor- 
tant that teens with online access be taught how to use such services wisely and 
safely. To this end, Microsoft is a member of the Ad Council’s Internet Safety Coali- 
tion, which is working to help kids understand that the Internet is a public place 
and to explain the risks of ill-considered Internet posting. Microsoft also provides 
parents with a number of educational resources and technology tools so that they 
can talk to their teens about the importance of privacy and safety online and be 
more involved in their online activities. 6 We are committed to working with Con- 
gress to make sure parents, educators, and children are aware of these resources 
and take advantage of them. Microsoft has no special insight into the types of infor- 
mation that children are disclosing online in general or into the privacy practices 
of other companies. 

Question 13. Could you describe your company’s efforts to educate parents and 
teachers about online safety? 

Answer. While Microsoft has created a number of tools and technologies to help 
promote child privacy and safety on the Internet, we believe that educating parents, 
teachers, and children is one of the most effective ways to respond to online risks. 
To this end, we offer a number of educational resources for parents, teachers, and 
children regarding the importance of online privacy and safety. 7 We also support nu- 
merous family safety educational organizations and outreach efforts. For example, 
Microsoft is a sponsor of i-SAFE America’s i-LEARN program, which provides free 
online curriculum for educators, parents, and teens. 8 We helped to create, along 
with other technology companies, the National CyberSecurity Alliance, whose mis- 
sion is to educate all users, including parents and children, about how to stay safe 
online. 9 Microsoft also supports GetNetWise, a public education organization that of- 
fers Internet users resources for making informed decisions about safer Internet 
use. 10 A representative list of Microsoft’s educational efforts is provided in the at- 
tachment to my written testimony. 11 

Question 14. How do you work with law enforcement to combat Internet crime? 

Answer. Microsoft is committed to helping make the Internet safer for all users — 
including children and families — but we can’t do it alone. Therefore, Microsoft part- 
ners with law enforcement agencies to combat Internet crime. 12 For example, Micro- 
soft has partnered with the National Center for Missing and Exploited Children 
(“NCMEC”) to develop and deploy technology solutions that disrupt the ability of on- 
line predators to exploit children or traffic in child pornography. We also have 
worked with Interpol and the International Centre for Missing and Exploited Chil- 
dren (“ICMEC”) to sponsor worldwide training sessions for law enforcement per- 
sonnel on computer-facilitated crimes against children. In addition, Microsoft works 
extensively with the Department of Justice’s Internet Crimes Against Children Task 
Force and has worked with a number of state Attorneys General to provide com- 
prehensive training for law enforcement on computer-facilitated crimes. 

Question 15. What should the FTC or Congress do to strengthen children’s safety 
and privacy online in conjunction with advanced technologies and mobile devices? 

Answer. One of the advantages of the COPPA statute is that it provides a flexible 
framework by which the FTC can quickly adapt its rules to accommodate advanced 
technologies, including mobile devices. The FTC recently launched a proceeding to 


6 See http .7 / www.microsoft.com / protect / family . 

1 See http :/ / www.microsoft.com / protect / family . 

8 See http :/ / www.ilearn.isafe.org. 

9 See http: I / www.staysafeonline.org / . 

10 See http: / / www.getnetwise.org. 

17 See pp. 7—8, available at http:/ / download.microsoft.com / documents / uk / education / home 
accessprogramme / FamilySafety- US. pdf. 

12 See id. at 9—10. 
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look into this issue, and Microsoft will be participating in that process. We believe 
that the FTC can strengthen children’s safety and privacy online by providing clear 
guidance on how companies can better meet not only the letter, but also the spirit, 
of the law in light of advanced technologies and by addressing the weaknesses of 
the currently approved approaches to obtaining verifiable parental consent. We do 
not believe that amending the statute is necessary at this time. At the very least, 
we believe it would be prudent to allow the FTC to complete its Rule review before 
determining whether legislative action is necessary. 

Question 16. Do you agree with the direction the FTC is taking as it reexamines 
the implementation and effectiveness of COPPA? 

Answer. Yes, we agree with the direction the FTC is taking for its COPPA Rule 
review. We commend the FTC for taking the initiative to launch its review 5 years 
early in light of children’s increasing use of new technologies to access the Internet. 
We expect that the FTC’s comprehensive review process will produce a strong public 
record that will help inform the FTC as it considers whether modifications of the 
COPPA Rule are needed. 

Question 17. How do you propose to improve parental supervision and control of 
children’s online activity to prevent the inappropriate or illegal collection and use 
of their information? 

Answer. We recommend that the FTC update two key aspects of the COPPA Rule 
in order to improve parental supervision and control of children’s online activity. 
First, we hope that the FTC will use its review process to encourage companies that 
provide sites and services that are attractive to children to be more proactive about 
creating opportunities for parental engagement in their children’s online activities. 
Second, we urge the FTC to work with technology companies and consumer advo- 
cates to develop more consumer-friendly, effective, and scalable methods for obtain- 
ing parental consent, especially in the context of mobile devices. 

We also believe in empowering parents through parental controls. To this end, we 
make available tools for a number of our services, such as Windows Live and Xbox 
Live, that help parents make granular choices about how their children may share 
personal information online. For example, Microsoft’s parental controls enable par- 
ents to limit their children’s searches, block (or allow) websites based on the type 
of content, restrict with whom their children can communicate, and access detailed 
activity reports that show the websites their children visited and the games and ap- 
plications they used. 

Question 18. If you support a regime granting rules of the road for adolescents’ 
privacy, how do you envision this sort of regime working? How would you propose 
it be structured? If you do not support a regime governing adolescents’ privacy, 
please explain your reasoning. 

Answer. Microsoft has long supported comprehensive Federal privacy legislation 
that would establish baseline protections and enhance the privacy of all individ- 
uals — including adolescents. 13 In addition, we believe that a key element of pro- 
tecting privacy for adolescents is to find ways to effectively encourage parental in- 
volvement in their online activity. Microsoft provides parents with a number of edu- 
cational resources and technology tools so that they can talk to their teens about 
the importance of privacy and safety online and be more involved in their online 
activities. We are committed to working with Congress to advance these important 
efforts. 


Response to Written Questions Submitted by Hon. Mark Pryor to 
Kathryn C. Montgomery 

Question 1. Do you think the age limit in COPPA is appropriate? And if so, why? 

Answer. The regulations that were put in place for COPPA are appropriate for 
children under the age of 13, and were designed to provide protections specifically 
for this age group. They are part of a long tradition of advertising policy safeguards 
that are based on social science research dating back to the 1970s. However, be- 
cause COPPA only covers young children, online marketers have developed a spec- 
trum of techniques for data collection and targeting focused on adolescents, with vir- 
tually no government oversight. Recent research in neuroscience and adolescent de- 
velopment has identified a number of ways in which adolescents are vulnerable to 
new forms of marketing, particularly in the digital context (See articles by Profes- 
sors Frances Leslie and Constance Pechmann at the University of California, Irvine 
at digitalads.org. See also Kathryn C. Montgomery and Jeff Chester, “Interactive 


13 See, e.g., http:/ / www.microsoft.com / presspass / features / 2005 / nov05 / ll-03Privacy.mspx. 
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Food and Beverage Marketing: Targeting Adolescents in the Digital Age,” Special 
supplement to Journal of Adolescent Health. September, 2009: 1-12.) New legisla- 
tion is needed to provide adolescents with substantive protections from unfair data 
collection and marketing practices. 

Question 2. Do you think COPPA should be strengthened? 

Answer. Under its current review of COPPA, the FTC needs to ensure that the 
rules are updated to apply to evolving data collection and targeting practices. These 
include: behavioral profiling, ad networks, social networking platforms, location tar- 
geting and other mobile practices, etc. COPPA legislation was drafted with sufficient 
flexibility to accommodate these new practices, but they need to be articulated clear- 
ly in the updated FTC rules to ensure that the law is implemented effectively. 

Question 3. Should the FTC reexamine what constitutes “personal information” in 
its review of COPPA? Or do you believe that the online space and the definition of 
personal information should remain the same as it was when the law was created 
over 10 years ago? 

Answer. The FTC should reexamine the definition of Personal Information in 
COPPA. Its current definition only covers a few examples of what constitutes per- 
sonally identifiable information. However, the law includes a clause (SEC. 1302 8, 
F) that was designed to ensure that evolving practices are included in the definition 
of personal information: “any other identifier that the Commission determines per- 
mits the physical or online contacting of a specific individual.” With the growth in 
behavioral profiling practices, digital marketers can now use a variety of new identi- 
fiers, including IP address, cookies, and other “passive” forms of data collection, to 
easily identify and target an individual child. As the work of Professor Paul Ohm 
at the University of Colorado shows, the ability of data bases to re-identify individ- 
uals is growing. Narrow definitions of PII do not capture how industry treats data 
about individuals. 

The FTC has already recognized the need to expand the definition of personally 
identifiable information in some of its other documents, including the FTC Staff Re- 
port on Self Regulatory Principles for Online Behavioral Profiling (Feb, 2009), which 
recognizes that Personal Information can include the tracking of given devices, com- 
puters or browsers. The European Commission’s Article 29 Working Party has also 
articulated the need to redefine personal information. 

Question 4. In your opinion, what is the biggest threat to children’s privacy and 
safety in today’s online world? 

Answer. The biggest threat is the creation of a vast infrastructure for data collec- 
tion in a variety of networked technologies and platforms used by children and ado- 
lescents. Current and emerging industry practices are designed to maximize data 
collection while minimizing transparency. Each new technology available to the pub- 
lic brings with it a new way for data collection to occur, and little if any discussion 
about the impact or planned uses of this data. 

Question 5. What do you think is the most urgent update to COPPA needed? 

Answer. As outlined above, the most urgent need is to ensure that current regu- 
latory and self-regulatory safeguards are applied to new platforms and practices for 
data collection and targeted marketing. 

Question 6. In your opinion, what would constitute the most appropriate definition 
of “sensitive data” in the context of children’s online privacy? 

Answer. Any data about children and teens should be considered sensitive. In 
many ways, both children and adolescents are “sensitive users,” who should be af- 
forded special protections. Teens and children have limited developmental capacities 
for understanding fully the trade-offs involved in today’s data collection and mar- 
keting environment. 

Question 7. Do you think any incentives exist for children to refrain from reveal- 
ing information about themselves or do you think there is momentum encouraging 
young people to surrender their privacy? 

Answer. Revealing information is necessary for even the most basic of social and 
developmental interactions online. The most insidious data collection that occurs is 
the through surveillance by marketers of interactions that teens have with their 
friends, family, schools etc. (particularly on social networks). Policy should focus on 
protecting data, involving parents, and regulating data collectors, rather than dis- 
couraging children from interacting. 

Question 8. You helped negotiate COPPA when it was created and so you are fa- 
miliar with its bipartisan nature and flexibility. Do you believe the statute is suffi- 
ciently responsive to the challenges facing young people as much of their informa- 
tion appears to be mined and collected? 
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Answer. Those of us who negotiated COPPA understood that we were dealing 
with a new system of online marketing and data collection that would be undergoing 
dramatic growth and change during the ensuing years. One of the law’s purposes, 
from my vantage point, was to ensure that a system of safeguards was put in place 
during the earliest stage of ecommerce in order to guide the development of future 
practices and to establish a clear set of principles that young people needed protec- 
tions from unfair marketing and data collection. The language in the original stat- 
ute provides a mechanism for ongoing review by the FTC to ensure that these safe- 
guards are adapted to take into account the evolving practices and platforms of the 
growing digital media and marketing environment. However, these FTC reviews 
must be thorough, accurate, and timely enough to ensure that this original intent 
is carried out. 

Question 9. Researchers have suggested that marketers today can identify in real 
time where kids are, who their friends are, and what they are doing — representing 
some real privacy issues. Could you elaborate upon how this tracking works and 
what it could mean for young people’s security and privacy? 

Answer. Advances in what is called “computational advertising” now permit real- 
time tracking and targeting of online consumers (including youth) across a variety 
of platforms, employing a range of data collection and analysis techniques through 
cookies, tracking pixels, location and social networking data. “Social media mar- 
keting” applications, for example, can tap into social networks to identify a par- 
ticular individual and his or her networks of friends (through what is called the “so- 
cial graph.”) Sophisticated data mining tools enable stealth analysis of the content 
and communications people post to their social networking profiles, including videos, 
photos, music, etc. These practices not only subject young people to increasing num- 
bers of third party marketers, but also make them vulnerable to others who may 
be able to learn their location, interests and relationships. Social media marketing 
is growing very rapidly, raising a number of serious questions about the need for 
additional safeguards to protect children and adolescents. 

Question 10. Your testimony includes the following remark: “Ads on mobile 
phones will be able to reach young consumers when they are near a particular busi- 
ness and offer electronic pitches and discount coupons.” Does this mean that a 13- 
year old with a mobile device could receive undesired targeted ads based on her geo- 
graphic location and proximity to a specific business? Do you believe that is prob- 
lematic? 

Answer. Location targeting permits tracking and targeting of consumers (includ- 
ing youth) via their mobile devices. Increasingly as individuals’ locations are made 
available to third parties, mobile users will be marketed to in “real-time” via mobile 
coupons and other offers based on where they may be at a particular time (or based 
on analysis of their moves from and to various locations over time). Federal policies 
are needed to regulate mobile marketing to both children adolescents, and to ensure 
that real-time location and other behavioral information is kept private. Rules are 
also required to ensure meaningful opt-in policies that clearly and prominently ex- 
plain how the data are collected and used, as well as limits on the duration of loca- 
tion targeting consent. 

Question 11. The extent to which children understand how their information is 
being used is worth discussing. You state in your testimony, “When COPPA was cre- 
ated, one of our concerns was to ensure that the ability to identify, track, and target 
a child — whether online or off — was mediated through Congressional safeguards 
mandating parent involvement. And while young people — and adults — today are 
being continually urged to make more of their personal information available in 
real-time, including their location, research indicates [that] few people understand 
how that information is being collected and used.” How is young people’s informa- 
tion being used and to what extent are they aware of its use and collection? 

Answer. Research at UC Berkeley and the Annenberg School for Communication 
at the University of Pennsylvania has documented that the majority of the public, 
including youth, care very much about protecting their privacy in the online envi- 
ronment. However, all online consumers confront a non-transparent, pervasive, and 
largely unaccountable data collection system. Many youth oriented commercial sites 
encourage youth to give up large amounts of information about themselves and their 
friends without fully explaining how that information will be used. A growing num- 
ber of specialized data mining and behavioral targeting companies are tracking the 
behaviors of individuals as they conduct their daily activities on the Internet, in- 
cluding searching for health or other information, and interacting with friends on 
social networks, with very little disclosure of how the marketing apparatus func- 
tions. 
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Question 12. You wrote in your written statement: “Social networks have created 
privacy settings that create a false sense of security for teens.” What did you mean 
by that remark? 

Answer. Social network privacy settings often are aimed at limiting how data is 
shared or made available to other social network users. They do not address how 
the social network, its advertisers, or third party applications retain and use the 
data. Nor may the settings be that effective, allowing someone who may be a casual 
acquaintance, but listed as a “friend,” gain access to your information. Companies 
such as Facebook and MySpace may enable users to restrict who has access to their 
profiles and activities, but these companies do not adequately inform users about 
the nature and extent of commercial practices on these networks, involving data col- 
lection, surveillance, and behavioral profiling. 

Question 13. You advocated for a regime to protect adolescents’ privacy. How do 
you envision this sort of regime working? How would you propose it be structured? 

Answer. Adolescents should receive protections in line with the Fair Information 
Practices principles created by the OECD, as well as a set of more granular safe- 
guards developed specifically for this age group. (See below for additional informa- 
tion in response to this question.) 

Question 14. What should the FTC or Congress do to strengthen children’s safety 
and privacy online in conjunction with advanced technologies and mobile devices? 

Answer. The recent oversight hearing by the subcommittee chaired by Sen. Pryor 
(along with the participation of Commerce Committee Chairman, Sen. Rockefeller) 
has already helped underscore why ensuring protecting the privacy of young people 
is a key public policy concern. I urge the Committee to oversee the work of the FTC 
in this area, and to conduct additional hearings, including a review of the final rec- 
ommendations made by the FTC on new COPPA implementation rules. I also urge 
the Subcommittee to conduct hearings and introduce new legislation designed to 
protect adolescent privacy online. 

Question 15. Do you agree with the direction the FTC is taking as it reexamines 
the implementation and effectiveness of COPPA? 

Answer. Through its 2010 evaluation of COPPA, the FTC is working to address 
how the implementation of the law can better protect children under 13. I believe 
the FTC should also conduct independent research to document how young people’s 
data is being collected from new practices, including behavioral targeting and mo- 
bile marketing. Because so many of these practices are not transparent, the Com- 
mission should be encouraged and, if need be, specifically authorized, to conduct in- 
vestigations of contemporary advertising and data collection in the children’s digital 
marketplace, and should use its subpoena power to solicit data from industry about 
how it interacts with children. 

Question 16. How do you propose to improve parental supervision and control of 
children’s online activity to prevent the inappropriate or illegal collection and use 
of their information? 

Answer. The FTC should include in its current review an analysis of how well 
parents are able to rely on the current parental verification mechanisms and wheth- 
er any of these mechanism have created loopholes that enable marketers to target 
individual children inappropriately. This should include reviewing currently ap- 
proved safe harbor regimes to determine whether outside parties may have access 
to young people’s data. 

Question 17. If you support a regime granting rules of the road for adolescents’ 
privacy, how do you envision this sort of regime working? How would you propose 
it be structured? If you do not support a regime governing adolescents’ privacy, 
please explain your reasoning. 

Answer. I would support broad legislation to protect all consumers, based on a 
framework of fair information principles. Within that framework, additional safe- 
guards should be established to address specifically the needs of youth age 13-17, 
who are not covered by COPPA. A Fair Marketing Digital Bill of Rights for Teens 
would balance the ability of young people to participate fully in the digital media 
culture — as producers, consumers, and citizens — with the governmental and indus- 
try obligation to ensure adolescents are not subjected to unfair and deceptive sur- 
veillance, data collection, and behavioral profiling by marketers. The onus of respon- 
sibility should not only be placed on youth to protect themselves, but also on the 
companies that market to them. Fair marketing and data collection rules are needed 
to help ensure that young people are socialized to be responsible consumers in the 
growing digital marketplace, and to understand their rights to privacy. 

While some elements of COPPA could serve as a useful model for adolescent on- 
line privacy policy, I do not believe the mechanism for parental approval is appro- 
priate or advisable in the case of teens. The legislation should include: 
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• The principle of maximizing user control over their information while mini- 
mizing data collection. 

• Congressional authorization that directs the FTC to conduct research, hold 
workshops, and develop rules to ensure consumer protections for teens in digital 
marketing, with a special focus on data collection and behavioral profiling. 

• Effective, full disclosure of marketing and data collection practices with mean- 
ingful opt-in: 

° User-friendly, granular information that is prominently displayed at times 
and in places where teens will read and understand it. 

° Opt-in mechanisms that are tailored to a variety of digital platforms, includ- 
ing mobile, social networks, etc. 

• Limitations on the amount of data, types of data, and retention of data collected 
from adolescents for digital marketing purposes. 

• Limitations on behavioral profiling and targeting of adolescents, as well as re- 
strictions on other practices that may take advantage of under age youth, such 
as sharing with third parties, retargeting, location targeting, and computational 
advertising. 

• Special privacy rules for social networks, mobile, and interactive games. 

• Like COPPA, a government regulatory framework, along with self-regulatory 
regimes that create a level playing field for both consumers and businesses by 
implementing “rules of the road” for marketing to teens. 

• Mechanisms for accountability and independent assessment, and fines for fail- 
ure to comply with rules. 

• Built in flexibility of rules to ensure continued effectiveness as digital mar- 
keting practices evolve and expand. 


Response to Written Questions Submitted by Hon. Mark Pryor to 

Berin Szoka 

Thank you, Chairman Pryor, for the opportunity to supplement my written testi- 
mony from this hearing by responding to your questions. 1 In my responses, I have 
incorporated some of the material found in the comprehensive survey of the perils 
of expanding COPPA’s scope beyond its original, limited purposes (what we have 
called “COPPA 2.0”) that my colleague Adam Thierer and I published in May 2009: 
COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & Free 
Speech . 2 Further detail on many of the points below can be found in that paper. 

I. A Reexamination of COPPA 

It bears repeating at the outset that the Federal Trade Commission’s (FTC) cur- 
rent proceeding is not examining the Children’s Online Privacy Protection Act 
(“COPPA”) itself (the statute ), 3 but rather the “COPPA Rule” (the regulations man- 
dated by the agency pursuant to COPPA). 4 The agency is well aware of this distinc- 
tion — and, indeed, far more precise about it than probably any interested party. For 
example, the agency’s recent inquiry is titled “Request for Public Comment on the 
Federal Trade Commission’s Implementation of the Children’s Online Privacy Pro- 
tection Rule.” 5 But it is a distinction that is far too often lost on many advocates 
who are lobbying for change. 

Congress, of course, retains the authority to change the COPPA statue at any 
time, and it is well within the jurisdiction of this committee to consider doing so. 
But in re-examining COPPA, lawmakers should tread carefully. Any attempts to re- 
open COPPA to expand the statute beyond its original, limited purposes could raise 


1 Written Testimony of Berin Szoka, Hearing on “An Examination of Children’s Privacy: New 
Technologies & the Children’s Online Privacy Protection Act” before the Subcommittee on Con- 
sumer Protection, Committee on Commerce, Science, and Transportation, U.S. Senate, April 29, 

2010, www.pff.org / issues-pubs / testimony 1201 0 / 201 0-04-29-Szoka Written COPPA Testimo 

ny.pdf. 

2 Berin Szoka & Adam Thierer, COPPA 2.0: The New Battle over Privacy, Age Verification, 
Online Safety & Free Speech, Progress on Point 16.11, May 2009, http : / lpff.org/issues-pubsl 
pops 12009 / pop 7 6.11 -COPPA-and-ageverification.pdf (“COPPA 2.0”). 

3 15 U.S.C. §§6501-6506. 

4 16 C.F.R. Part 312. 

5 Federal Trade Commission, Children’s Online Privacy Protection Rule: Request For Public 
Comment on the Federal Trade Commission’s Implementation of the Rule, 75 Fed. Reg. 17,089, 
April 5, 2010, http: 1 1 www.ftc.gov / os 12010 / 03 1100324coppa.pdf (COPPA Implementation Re- 
view). 
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serious constitutional questions about the First Amendment rights of adults as well 
as older teens and site and service operators, and also have unintended consequences 
for the health of online content and services without necessarily significantly increas- 
ing the online privacy and safety of children. 

A. Do you think the age limit in COPPA is appropriate ? And if so, why ? 

Yes, and understanding why is the key to understanding the delicate balance of 
COPPA in general. The COPPA Rule’s requirements are relatively easy for site and 
service operators to implement, and for the government to enforce, because they 
apply only to the collection of information about children under 13 by commercial 
operators (or the public sharing of information by children themselves) only when: 
(i) the operator’s site or service is “directed to children” or (ii) the operator has ac- 
tual knowledge that they are collecting personal information from a child. But the 
key practical difficulty in implementing a COPPA 2.0 system for adolescents 13 and 
above is in the anonymity inherent in the technical architecture of the Internet. To 
quote a memorable cartoon from The New Yorker : “On the Internet, nobody knows 
you’re a dog.” 6 Because website operators generally do not know who is accessing 
their site, requiring any special treatment of minors is tantamount to requiring age- 
verification of all users. 7 Again, COPPA’s ingenious solution to this problem is that 
the law applies only to the limited “Internet Jr.” of sites “directed at children,” or 
in cases where an operator has “actual knowledge” that it is dealing with a child. 

Because “child-oriented” websites are generally easy to define and are very rarely 
used by adults, COPPA’s age verification mandate has not significantly impacted 
the free speech rights of adults because few adults other than parents ever want 
to use these sites, and parents essentially are already age verifying themselves in 
the process of providing “verifiable trial consent” for their children (those under 13). 
But it is far more difficult to define a class of “adolescent-oriented” websites (i.e., 
“directed at” kids age 13-17, as proposed in New Jersey in 2008 8 ) that are not also 
used by significant numbers of adults. The practical result of such COPPA expan- 
sion efforts would be the same as simply specifying that a certain category of 
websites (such as those with a public “wall,” as proposed in Illinois in 2008 9 ) must 
age-verify of a large number of adults to distinguish adults (who do not require 
verifiable parental consent) from children (who do require verifiable parental con- 
sent). This raises profound First Amendment concerns — particularly about the right 
of Americans to speak and receive information anonymously online. 10 

It was at least in part in recognition of the difficult First Amendment questions 
discussed below that Congress removed the requirement in the initial legislative 
draft of COPPA that would have required operators to “use reasonable efforts to 
provide the parents with notice and an opportunity to prevent or curtail the collec- 
tion or use of personal information collected from children over the age of 12 and 
under the age of 17.” 11 


6 Peter Steiner, On the Internet, Nobody Knows You’re a Dog, The New Yorker, July 5, 1993, 
at 61, available at www.unc.edu/depts/jomc/academics/dri/idog.html (cartoon of a dog, sitting 
at a computer terminal, talking to another dog). 

7 Of course, the COPPA’s second prong of age-verification requirement applies only when the 
website operator has “actual knowledge” that the user is a minor. 16 C.F.R. § 312.3. 

8 A.B. 108, Gen. Assem., 213th Leg. Sess. (N.J. 2008), www.njleg.state.nj.us/2008/Bills/ 
A0500I108_I1.HTM. 

9 H.B. 1312, 96th Gen. Assem., Synopsis as Introduced (II. 2007) [hereinafter SNWARA I, avail- 
able at www.ilga.gov /legislation / billstatus.asp?DocNum= 13 12&GAID=10&GA=9G&DocTypeID= 
HB&LegID=43038&SessionID=76. 

10 See infra at 3-9.; see generally, COPPA 2.0, supra note 2; Adam Thierer, The Progress & 
Freedom Foundation, USA Today, Age Verification, and the Death of Online Anonymity, PFF 
Blog, Jan. 23, 2008, http:/ / blog.pff.org/archivesl2008/01lusa today doesn.html. 4 

11 This requirement was contained in the original bill, Children’s Online Privacy Protection 
Act, S. 2326, 105th Cong. § 3(a)(2)(A)(iii), (1998), but was removed when that bill was reintro- 
duced in its final form. In the interim, Congress held a hearing at which testimony was offered 
by, among others, Deirdre Mulligan, on behalf of the Center for Democracy and Technology, 
which generally supported COPPA but argued for the very revisions that were ultimately made. 
In particular, Mulligan argued that: 

under the bill each time a 15 year old signs-up to receive information through e-mail his or 
her parent would be notified. For example if a 15 year old visits a site, whether a bookstore 
or a women’s health clinic where material is made available for sale and requests information 
about purchasing a particular book or merely inquires about books on a particular subject 
(abuse, religion) using their e-mail address the teenager’s parent would be notified. This may 
chill older minors in pursuit of information. 

Testimony of Deirdre Mulligan, Staff Counsel, Center for Democracy and Technology, before 
the Senate Committee on Commerce, Science, and Transportation Subcommittee on Communica- 

Continued 
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These First Amendment concerns are not conjectural: The courts have already 
struck down precisely this kind of broad age verification mandates — specifically, as 
found in the Children’s Online Protection Act (COPA), 12 another 1998 law some- 
times confused with COPPA. In essence, COPPA is focused on certain kinds of po- 
tentially harmful contacts while COPA is focused on potentially harmful content . 13 
COPA attempted to prevent children from accessing material deemed “harmful to 
minors” by requiring all users attempting to access such content to provide a credit 
card, on the theory that only adults have credit cards. But the courts concluded 
that, “payment cards cannot be used to verify age because minors under 17 have 
access to credit cards, debit cards, and reloadable prepaid cards” and, although 
“payment card issuers usually will not issue credit and debit cards directly to mi- 
nors without their parent’s consent because of the financial risks associated with 
minors . . . there are many other ways in which a minor may obtain and use pay- 
ment cards.” 14 

1. COPPA’s Current Age Range Respects the First Amendment Rights of Adults 

Besides the fact that credit cards were simply inadequate for proving that some- 
one was not a child (a very different problem from obtaining verifiable parental con- 
sent, as discussed below), the court held that requiring adults to prove that they 
were not children by providing credit card information violated the First Amend- 
ment in a number of ways. 

First, COPA burdened the speech rights of adults to access information subject 
to age verification requirements, both by making speech more difficult and by stig- 
matizing it. In 2003, the Third Circuit noted that age verification requirements “will 
likely deter many adults from accessing restricted content, because many Web users 
are simply unwilling to provide identification information in order to gain access to 
content, especially where the information they wish to access is sensitive or con- 
troversial ,” 15 In 2008, in striking down COPA for the third and final time, the 
Third Circuit approvingly quoted the district court, which had noted that part of the 
reason age verification requirements deterred users from accessing restricted con- 
tent was “because Internet users are concerned about security on the Internet and 
because Internet users are afraid of fraud and identity theft on the Internet.” 16 The 
Supreme Court has recognized the vital importance of anonymous speech in the con- 
text of traditional publication. 17 By imposing broad age verification requirements, 
COPPA 2.0 would restrict the rights of adults to send and receive information anon- 
ymously just as COPA did. If anything, the speech burdened by COPPA 2.0 deserves 
more protection, not less, than the speech burdened by COPA: Where COPA merely 
burdened access to content deemed “harmful to minors” (viz., pornography), COPPA 
2.0 would burden access to material by adults as well as minors, not because that 
material is harmful or obscene, but merely because it is “directed at” minors! Thus, 
the content covered by COPPA 2.0 proposals could include not merely pornography, 
but communications of a political nature, which deserve the highest degree of First 
Amendment protection. 

Second, COPA burdened the speech rights of operators because the necessary cor- 
ollary of blocking adults from accessing certain content anonymously — and thereby 
deterring some users from accessing that content — is reducing the audience of those 
sites. Similarly, if COPPA’s age ceiling were raised to cover adolescents, some 
websites would self-censor themselves to avoid offering content they fear could be 
considered “directed at” adolescents because doing so might subject them to an age 
verification mandate for all users — or to legal liability if they failed to implement 


tions. Sept. 23, 1998, http:! lweb.archive.org! web 120080327000913 1 http: 1 1 www.cdt.org I testi- 
mony / 980923mulligan.shtml. 

12 47 U.S.C. §231. 

13 COPA makes it illegal to “knowingly . . . make! 1 any communication for commercial pur- 
poses that is available to any minor and that includes any material that is harmful to minors.” 
47 U.S.C. 231. 

U ACLU v. Gonzales. 478 F. Supp. 2d 775, 801 (E.D. Pa. 2007) [hereinafter Gonzales ]. COPA 
would have prohibited the online dissemination of material deemed harmful to minors under 
17 for commercial purposes, 47 U.S.C. § 231(a)(1), subject to a safe harbor for sites that made 
a "good faith” effort to restrict access by minors: “(A) by requiring use of a credit card, debit 
account, adult access code, or adult personal identification number; (B) by accepting a digital 
certificate that verifies age; or (C) by any other reasonable measures that are feasible under 
available technology,” 47 U.S.C. § 231(c)(1). 

15 ACLU v. Ashcroft , 322 F.3d 240, 259 (3d Cir. 2003) (ACLU II). 

16 ACLU v. Ashcroft, 534 F.3d 181, 196 (3d Cir. 2008) (ACLU III) (citing Gonzales, 478 F. 
Supp. 2d 775 at 806). 

11 McIntyre v. Ohio Elections Comm’n, 514 U.S. 334, 342 (1995) (striking down law that pro- 
hibited distribution of anonymous campaign literature); see also Talley v. California , 362 U.S. 
60 (1960) (striking down a state law that forbade all anonymous leafletting). 
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age verification. The substantial cost of age verification could significantly impact, 
if not make impossible, the razor-thin business models of many sites, which gen- 
erally do not charge for content and rely instead on advertising revenues. The Third 
Circuit cited all of these burdens on the free speech rights of website operators in 
striking down COPA. 18 

Third, courts held that “[blocking and filtering software is an alternative that is 
less restrictive than COPA, and, in addition, likely more effective as a means of re- 
stricting children’s access to materials harmful to them.” 19 Similarly, parental con- 
trol software already empowers parents to restrict their kids’ access to websites and 
similar software is evolving for mobile services and smartphone software (i.e., appli- 
cations or “apps”) that would offer parents control over what services kids use that 
allow them to share their personal information, either with operators or with other 
users. 

Finally, it’s worth noting that COPPA 2.0 would restrict the ability of adolescents 
to access content (in interactive contexts where they might also share personal in- 
formation), not because it could be harmful to them or because it is obscene, but 
merely because it is “directed to” them. While the First Amendment rights of minors 
may not be on par with those of adults, adolescents do have the right to access cer- 
tain types of information and express themselves in certain ways. 20 The Supreme 
Court has held that “constitutional rights do not mature and come into being magi- 
cally only when one attains the state-defined age of majority.” 21 It remains unclear 
how an expanded COPPA model might interfere with the First Amendment rights 
of adolescents, but it is clear that privacy and speech rights would come into conflict 
under COPPA 2.0, as they do in other contexts. 22 

For example, how might the parental-consent based model limit the ability of ado- 
lescents to obtain information about “safer sex” or how to deal with trauma, depres- 
sion, family abuse, or addiction? Would an abusive father authorize a teen to visit 
a website about how to report child abuse? Would parents of adolescents struggling 
with their sexual identity let their children participate in a self-help social net- 
working page for gay and lesbian youth? 23 The rights are at play here are critically 
important and must be balanced carefully. 


18 See ACLU III, 534 F.3d at 196-97 (citing Gonzales, 478 F. Supp. 2d 775 at 804). The Court 
held that websites “face significant costs to implement *COPA’s age verification mandates+ and 
will suffer the loss of legitimate visitors once they do so.” Id. at 197. 

is Id. at 198 (quoting ACLU w. Mukasey, 534 F.3d 181, 198 (2008)). 

20 See Theresa Chmara & Daniel Mach, Minors’ Rights to Receive Information Under the First 
Amendment, Memorandum from Jenner & Block to the Freedom To Read Foundation, Feb. 2, 
2004, www.ala.org/ala / aboutala / offices / oif/ ifissues / issuesrelatedlinks / minor srights.cfm (sum- 
marizing case law regarding minors’ first amendment rights, especially in schools and in the 
context of mandates that public libraries filter Internet content); United States v. Am. Library 
Ass’n, 123 S. Ct. 2297 (2003), available at laws.findlaw.com / us / 000 / 02-361.html (upholding the 
constitutionality of a filtering software system applicable to minors); see generally, Tinker v. Des 
Moines Ind. Comm. School Dist., 393 U.S. 503 (1969) (upholding students’ rights to wear protest 
armbands and affirming that minors have speech rights), available at www.oyez.org/cases/ 
1960-1969 /1968/ 1968 _21; cf. Morse v. Frederick, 551 U.S. 393 (2007), available at 

www.oyez.org / cases / 2000-2009 / 2006 / 2006 06 278/ (holding that the First Amendment rights 

of students in school and at school-supervised events are not as broad as those of adults in other 
settings). 

21 Planned Parenthood of Cent. Mo. v. Danforth, 428 U.S. 52, 74 (1976) (minors’ right to abor- 
tion). See also Bellotti v. Baird, 443 U.S. 622, 635 n.13 (minors possess close to the “full capacity 
for individual choice which is the presupposition of First Amendment guarantees”); Catherine 
Ross, An Emerging Right for Mature Minors to Receive Information, 2 U. Pa. J. Const. L. 223 
(1999); Lee Tien & Seth Schoen, Reply Comments of the Electronic Frontier Foundation filed 
in Implementation of the Child Safe Viewing Act; Examination of Parental Control Technologies 
for Video or Audio Programming , MB Docket No. 0926, Federal Communications Commission, 

May 18, 2009, http: / / fjallfoss.fcc.gov / prod / ecfs / retrieve. cgi ? native or pdf=pdf&id document 

=6520216901. 

22 See generally Solveig Singleton, Privacy Versus the First Amendment: A Skeptical Ap- 
proach, 11 Fordham Intell. Prop. Media & Ent. L.J. 97 (2000), available at http:/ / 
law.fordham.edu / publications / articles / 200flspub6588.pdf; Eugene Volokh, Freedom of Speech 
and Information Privacy: The Troubling Implications of a Right to Stop People from Speaking 
About You, 52 Stan. L. Rev. 1175 (2000), available at www.law.ucla.edu/volokh/privacy.htm. 

23 “There are parents who, for a variety of reasons (political, cultural, or religious beliefs, igno- 
rance of the facts, fear of being exposed as abusers, etc.), would deliberately prevent their teens 
from accessing social-network sites (SNS).” Internet Safety Technical Task Force, Enhancing 
Child Safety & Online Technologies: Final Report of the Internet Safety Technical Task Force 
to the Multi-State Working Group on Social Networking of State Attorneys General of the United 
States, Dec. 31, 2008, Appendix F, Statement of Connect Safely, at 262, http:// 
cyber.law.harvard.edu/pubrelease/isttf (listing examples of unintended consequences of age 
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Preserving the ability of adolescents to participate in online interactions goes be- 
yond content that most people would recognize as “serious” — from the perspective 
of both First Amendment values and the education of children. As a recent Mac- 
Arthur Foundation study of the youth Internet use concluded: 

Contrary to adult perceptions, while hanging out online, youth are picking up 
basic social and technological skills they need to fully participate in contem- 
porary society. Erecting barriers to participation deprives teens of access to 
these forms of learning. Participation in the digital age means more than being 
able to access “serious” online information and culture. 24 

Even if parents have an absolute right to block their adolescents’ access to such 
data, they can better exercise that right by applying strict controls on the computers 
in their home. As discussed below, there are ways to encourage innovation in such 
parental empowerment tools without changing COPPA itself. But COPPA 2.0 pro- 
posals go well beyond recognizing parents’ rights by making parental consent a “de- 
fault” requirement for adolescents to access a wide range of content — meaning that 
parents must “opt-in” on behalf of their children before their children can partici- 
pate in sites and services covered by COPPA. This, in turn, burdens the ability of 
adolescents to communicate, because their parents might censor (rightly or wrongly) 
certain information, or simply fail to understand the technologies involved or be re- 
sponsive to the opt-in requests when their kids want to access a new interactive site 
or service. But whatever the free speech rights of adolescents, if anyone should be 
interfering with those rights, it should be their parents — not the government. 

2. COPPA’s Current Age Range Allows Beneficial Communication between 
Adolescents and Adults 

Finally, COPPA 2.0 could infringe on the free speech rights of adults to commu- 
nicate with adolescents online by driving operators to segregate users by age or to 
attempt to block access by adolescents. As explained below, for the sake of marginal 
(if any) gains in child protection, we would be excluding beneficial interaction be- 
tween adults and minors. 

The vast majority of online interactions between adults and minors are not of a 
harassing, predatory or otherwise harmful nature — indeed, they generally involve 
adults looking to help or assist minors in various ways. As the MacArthur Founda- 
tion study cited above concluded: 

In contexts of peer-based learning, adults . . . have an important role to play, 
though it is not the conventionally authoritative one. In friendship-driven prac- 
tices, direct adult participation is often unwelcome, but in interest-driven 
groups we found a much stronger role for more experienced participants to play. 
Unlike instructors in formal educational settings, however, these adults are pas- 
sionate hobbyists and creators, and youth see them as experienced peers, not 
as people who have authority over them. These adults exert tremendous influ- 
ence in setting communal norms and what educators might call “learning goals,” 
though they do not have direct authority over newcomers . 2S 

A substantial portion of those interactions involve parents talking to their own 
kids, older and younger siblings communicating with one another, teachers and 
mentors talking to their students, or even co-workers of different ages commu- 
nicating. Even when adult-minor communications involve complete strangers, there 
is typically a socially-beneficial purpose. Examples include debating politics on a dis- 
cussion board, or collaboratively editing a Wikipedia entry, or communicating and 
collaborating on a common purpose on a Presidential campaign website involving 
millions of volunteers of all ages. There are countless other examples. Such inter- 
actions could be severely curtailed by COPPA 2.0 proposals. Restricting such inter- 
actions would raise profound First Amendment concerns about freedom of speech as 
well as of association. 

In any First Amendment analysis, a court must consider not only the free speech 
rights at stake and the availability of less restrictive alternatives to regulation, but 
the governmental interest being advanced. Again, neither COPPA nor the COPPA 
2.0 proposals recently contemplated at the state level require exclusion of older 
users from a website, nor directly govern the sharing of personal information among 


verification mandates) [hereinafter ISTTF Final Report ]. Full disclosure: Adam Thierer was a 
member of this task force. 

24 John D. and Catherine T. MacArthur Foundation, Living and Learning with New Media: 
Summary of Foldings from the Digital Youth Project, at 2 [hereinafter MacArthur Study 1 
http:/ / digitalyouth.ischool.berkeley.edu / files / report / digitalyouth-WhitePaper.pdf. 

25 MacArthur Study, supra note 24, at 2. 
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users (where that sharing does not also constitute collection by the site itself). But 
separation of adolescents from adults is likely to be an indirect effect of COPPA 2.0 
requirements — as COPPA 2.0 advocates probably realize — because, once operators 
are required to age-verify users, they will face reputational, political and potentially 
legal pressure to make interactions between adolescents and children more difficult 
in the name of “child safety.” More subtly, if site operators have an incentive to 
avoid having their sites be considered “directed at” adolescents, they will also have 
an incentive to discourage adolescent participation on their sites — which achieves a 
similar result. 

Given the lack of strong identity records for minors, it’s much easier for an adult 
to pretend to be a minor than vice versa. Thus, one must further ask if attempting 
to quarantine children from adults (however indirectly) actually advances, on net, 
a strong governmental interest in child protection. Such a quarantine is unlikely to 
stop adults with truly nefarious intentions from communicating with minors, as sys- 
tems designed to exclude participation by adults in a “kids-only” or “adolescents- 
only” area can be easily circumvented. The effect of age stratification on truly bad 
actors is likely to be marginal at best — or harmful at worst: Building walls around 
adolescents through age-verification might actually make it easier for predators to 
target teens, since a predator who gains access to a supposedly teen-only site will 
be less likely to be exposed as a predator than by targeting an adult the predator 
thinks is a teen. 

To hear some of the advocates of COPPA expansion talk about how teens cur- 
rently behave online, one might think that online environments in which adoles- 
cents were left to their own devices — imagine a “Teen MySpace” for the 13-17 
crowd, walled off from the rest of MySpace — would be far worse, perhaps an online 
version of Lord of the Flies. These concerns are clearly exaggerated: The critics fre- 
quently complain about “the way kids talk to each other these days” while looking 
at their own past adolescent banter with rose-tinted glasses. What is clear is that 
adolescents (and young adults) behave better in online environments where adults 
are present, too. Perhaps the best demonstration of this fact has been the uproar 
from adolescents and young adults that has accompanied Facebook’s explosive 
growth in popularity among older users. 26 Many kids hate the idea of adults joining 
Facebook precisely because the presence of adults encourages kids to “self-regulate” 
by exercising better judgment and following better netiquette. 27 

Anne Collier, founder and executive director of the child safety advocacy organiza- 
tion Net Family News, Inc. and editor ofNetFamilyNews.org and ConnectSafely.org, 
suggests that the push for “segregation” by age (e.g., creating a teen-only version 
of Second Life) for safety’s sake is “losing steam” because: 

It’s a response to the predator panic teens and parents have been subjected to 
in U.S. society, not to the realities of youth on the social Web. What nearly a 
decade of peer-reviewed academic research shows is that peer-to-peer behavior 
is the online risk that affects many more youth, the vast majority of online kids 
who are not already at-risk youth offline. Segregating teens from adults online 
doesn’t address harassment, defamation, imposter profiles, cyberbullying, etc. It 
may help keep online predators away from kids (even though online predation, 
or abuse resulting from online communication, constitutes only 1 percent of 
overall child sexual exploitation . . .), which is a great outcome, but it’s not 
enough unless all that parents are worried about is predators. 28 

Of course, adults play a critical role in disciplining interaction among the 0-12 
age bracket, but not as direct participants in on-site interaction. Again, how many 


26 Justin Smith, Number of U.S. Facebook Users Over 35 Nearly Doubles in Last 60 Days , In- 
side Facebook Blog Mar. 25, 2009, www.insidefacebook.com/2009/03/25/number-of-us-facebook- 
users-over-35-nearly-doubles-inlast-60-days j . 

27 See e.g., Lori Aratani, When Mom or Dad Asks To Be a Facebook “Friend,” The Wash- 
ington Post, Mar. 9, 2008, www.washingtonpost.com/ wp-dyn/ content / article / 2008 / 03 / 08 / 
AR2008030801034.html . “T do not know if this has happened to anybody, but this morning I 
log on to Facebook and I have a new friend request!’ wrote 19-year-old Mike Yeamans, a sopho- 
more at James Madison University, on one of several ‘No Parents on Facebook’ groups that have 
popped up on the site. ‘I am excited to make a new friend so I click on the link. I could not 
believe what I saw. My father! This is an outrage!’ ” Id. 

28 Anne Collier, Where Will OnlineTeens Go Next?, May 1, 2009, www.netfamilynews.org/ 
2009 / 05 / where-will-online-teens-go-next.html (internal citations omitted). For evidence of at-risk 
youth, Collier sites the ISTTF Final Report, supra note 47. Regarding the percentage of all child 
sexual exploitation that results from online communication, she cites Janis Wolak, David 
Finkelhor & Kimberly Mitchell, Crimes Against Children Research Center, Trends in Arrests 
of Online Predators, 2009) www.unh.edu/ccrc/pdf/CV194.pdf; see also, Anne Collier, Major Up- 
date on Net predators: CACRC study, March 31, 2009, www.netfamilynews.org / 2009 / 03 / 
majorupdate-on-net-predators-mostly.html (summarizing study). 
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adults actually want to use Club Penguin, a site clearly geared toward the Net’s 
youngest users? Instead, parents can supervise what their kids do online through 
parental control software. Parents could, of course, use that same software to mon- 
itor what their adolescent kids do, too. But as kids get older, most parents realize 
that the training wheels have to come off at some point. Few parents will want to 
spy on their 17-year-old until the day before the kid starts college (or enlists in the 
military or gets married). But most parents probably would prefer that, if their kids 
are interacting in an online environment, they think twice about what they do and 
say online. It is by no means clear that restricting online interaction between teens 
and adults will serve that end. 

B. Do you think COPPA should be strengthened ? 

I have seen no evidence of a need for Congress to reopen COPPA, and to the ex- 
tent that some changes may be necessary in the implementation of COPPA, I be- 
lieve the statute affords the FTC great flexibility in its definition of “Internet,” as 
discussed below, as well as in allowing the agency to update the definition of “per- 
sonal information.” Thus, while there may be ways to improve implementation of 
the statute, I do not see a need for changing COPPA itself today. 

Moreover, Congress must be cognizant of the downsides of reopening COPPA 
and — to the extent it is expanded along the lines some of have advocated — raising 
the prospect of the entire law being struck down as unconstitutional because it es- 
sentially converges with COPA, as Adam Thierer and I have explained in our 
work. 29 Again, COPPA is one of the few Internet laws Congress has passed over the 
last 15 years that was not challenged, blocked from taking effect, or overturned. 

C. Should the FTC reexamine what constitutes “personal information” in its review 

of COPPA? Or do you believe that the online space and the definition of personal 

information should remain the same as it was when the law was created over 

10 years ago? 

As I noted in my testimony, COPPA already gives the FTC the flexibility to up- 
date the definition of “personal information” to include “any other identifier that the 
Commission determines permits the physical or online contacting of a specific indi- 
vidual.” 30 Because the definition of personal information also includes “information 
concerning the child or the parents of that child that the website collects online from 
the child and combines with [any of these identifiers],” the statute already covers 
essentially all information tied to a particular user where it is possible to contact 
that user. This dynamic definition is broad enough to keep pace with technological 
change because it is not simply a static listing of the “personal information” that 
was at issue in the late 1990s. For example, if the lodestar of “personal information” 
is the ability to contact a child, instant messaging screen names or social net- 
working pseudonyms might qualify as “personal information.” In your opinion, what 
is the biggest threat to children’s privacy and safety in today’s online world? 

The biggest threat to children’s online privacy and safety has always been, and 
will likely remain, the ignorance and naivete that necessarily comes with youth. 
Though children may be quite technologically adept, far more so than many parents, 
they still lack the real-world experience necessary to appreciate the potential pri- 
vacy and safety implications of heedlessly giving personal information away to site 
operators or, especially, making personal information publicly available to other 
Internet users. No amount of Federal legislation or regulation is going to keep chil- 
dren from divulging personal information if they aren’t aware of its dangers. So, as 
discussed below, if a lack of knowledge or sophistication is the problem, the primary 
answer must be education, education and more education, not regulation, regula- 
tion, and more regulation. 31 

D. What do you think is the most urgent update to COPPA needed? 

Again, the FTC should remove any doubt about the fundamental technological ag- 
nosticism of COPPA’s potential coverage (actual coverage depending on whether, in 
any particular context, “collection” occurs and whether the site is directed at chil- 
dren or the operator has actual knowledge that it is “collecting” personal informa- 
tion from a child). The FTC should also encourage the development of mechanisms 
for verifying parental consent appropriate to these technologies, either by recog- 
nizing additional mechanisms or through certifying innovative safe harbor opera- 
tors. Congress could direct, and fund, the FTC to conduct more education about 
COPPA, online privacy and online safety. 


29 See generally supra note 2. 
30 15 U.S.C. § 650K8XF). 
31 See infra at III.A.4. 
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E. In your opinion, what would constitute the most appropriate definition of 

“sensitive data” in the context of children’s online privacy ? 

COPPA already includes an excellent list of personal information: 

(A) a first and last name; 

(B) a home or other physical address including street name and name of a city 

or town; 

(C) an e-mail address; 

(D) a telephone number; 

(E) a Social Security number; 32 

As I noted in my testimony, COPPA already gives the FTC the flexibility to up- 
date the definition of “personal information” to include “any other identifier that the 
Commission determines permits the physical or online contacting of a specific indi- 
vidual.” 33 Because the definition of personal information also includes “information 
concerning the child or the parents of that child that the website collects online from 
the child and combines with [any of these identifiers],” the statute already covers 
essentially all information tied to a particular user such that it is possible to contact 
that user. Thus, there should be no need to specify additional categories of sensitive 
data to achieve COPPA’s purposes. 

F. You said in your written testimony that a “COPPA expansion would undermine 

privacy.” Would you mind explaining to the Committee your meaning? 

Sites that implement age verification technologies (even through COPPA’s 
“verifiable parental consent” loose form of age verification) require users to share 
personal information about themselves. Specifically, adults attempting to access 
sites behind an age verification wall would have to provide information adequate to 
establish that they are not, in fact, younger than whatever the higher age threshold 
of COPPA 2.0 might be. Similarly, children attempting to access such sites would 
have to provide information about themselves and their parents sufficient to estab- 
lish the parent-child relationship so that a site can reasonably evaluate documenta- 
tion purporting to establish “verifiable parental consent.” Both forms of age 
verification (by adults, and by children/parents) could be accomplished by a number 
of means, but seem to be most commonly done today through use of a credit card. 

Today, because COPPA requires age verification only for sites “directed at” chil- 
dren under 13 (or, in cases where an operator has “actual knowledge” that a par- 
ticular user is under 13), the law in practice requires only the second sort of age 
verification. But if COPPA were expanded to cover, say, all sites “directed at” ado- 
lescents (however defined), the law would very likely require certain website opera- 
tors to presume that all their users might be “children” whose parents’ “verifiable 
parental consent” must be obtained prior to collection. This, in turn, would mean 
that large numbers of adults would, for the first time since COPA, be required by 
law (or at least, the website operator’s interpretation of the law, which might tend 
to err on the side of caution) to age verify significant numbers of adults. As dis- 
cussed below, this creates a significant burden on the First Amendment rights of 
adults to anonymous communication through interactive services that could allow 
public sharing of personal information. This would also significantly burdens 
website operators whose audience might be reduced by the apprehension caused by 
age verification mandates among users worried about having to provide information 
for certification purposes or simply by the hassle of having to do so. In both re- 
spects, COPPA 2.0 would raise precisely the same constitutional problem that 
caused the courts to strike down COPA (but that are not raised by COPPA 1.0). 34 

But such an expansion of COPPA’s age scope would also undermine privacy by 
requiring the sharing of more personal information in order to age-verify newly cov- 
ered users. The same would be true of any attempts to expand COPPA by specifying 
that it applies to certain categories of websites (effectively disposing of the law’s “di- 
rected at” analysis). Thus, the irony of COPPA expansion is that lawmakers would 
be applying a law that was meant to protect the privacy and personal information 
of children to gather a great deal more information about kids, their parents, and 
many other adults. 

As the district court that struck down COPA noted: 

Requiring users to go through an age verification process would lead to a dis- 
tinct loss of personal privacy. Many people wish to browse and access material 


32 15 U.S.C. § 6501(8)(A-E). 
33 15 U.S.C. § 6501(8)(F). 

34 See supra at 3-9. 
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privately and anonymously, especially if it is sexually explicit. Web users are 
especially unlikely to provide a credit card or personal information to gain ac- 
cess to sensitive, personal, controversial, or stigmatized content on the Web. As 
a result of this desire to remain anonymous, many users who are not willing 
to access information non-anonymously will be deterred from accessing the de- 
sired information. 35 

The same is true even for non-explicit material, such as would be covered by 
COPPA if the law’s age range were expanded. 

G. Do you support the FTC’s review of COPPA? Do you believe it is necessary ? 

Yes, the FTC was well within its general operating procedures to accelerate its 
review of the COPPA Rules from 2015, the originally set date, to this year, 36 and 
it made sense for the agency to do so, given the pace of change in this area. In par- 
ticular, it appears from comments made by many in industry that the FTC needs 
to do more to make clear that COPPA is, by original Congressional design, platform- 
agnostic, applying to any “collection” (including publication or sharing by users 
themselves) of “personal information” through a website or online service — regard- 
less of the device used to access that site or service. 

H. If you oppose expanding COPPA, do you believe it is working properly ? Do you 

believe it is sufficient to protect children’s privacy? 

The original goals of COPPA, as expressed by its Congressional sponsors, were to: 

(1) to enhance parental involvement in a child’s online activities in order to pro- 
tect the privacy of children in the online environment; (2) to enhance parental 
involvement to help protect the safety of children in online fora such as 
chatrooms, home pages, and pen-pal services in which children may make pub- 
lic postings of identifying information; (3) to maintain the security of personally 
identifiable information of children collected online; and (4) to protect children’s 
privacy by limiting the collection of personal information from children without 
parental consent. 37 

Thus, as its name implies, COPPA is generally concerned with protecting the pri- 
vacy of children. But COPPA’s primary means for achieving this goal is enhancing 
parental involvement or, as the FTC has put it, “provid[ingl parents with a set of 
effective tools . . . for becoming involved in and overseeing their children’s inter- 
actions online.” 38 However admirable, “protectfing] the safety of children” is merely 
an indirect goal of COPPA — something to be achieved through the means of enhanc- 
ing parental involvement (COPPA’s direct goal). 

Viewed in this light, COPPA has probably been about as successful as could be 
expected given the fundamental technical reality of the Internet: In general, users 
and operators cannot, across the essentially infinite expanse of the digital chasm, 
definitively know how old other users are or even who they are. 

The FTC asserts COPPA “has provided a workable system to help protect the on- 
line safety and privacy of the Internet’s youngest visitors.” 39 Yet many of those ad- 
vocating expansion of COPPA do so on the grounds that COPPA makes children 
safer from sexual predators. What these advocates fail to acknowledge is that, to 
the extent COPPA has enhanced child safety — indeed, to the extent that COPPA 
can be effectively administered at all — it is because of the unique circumstances of 
the under-13 age bracket and the operators that have evolved to serve that commu- 
nity. In particular: 

1. The functionality of child-oriented sites is usually tightly limited: They are 
walled gardens; 

2. Many smaller websites catering to children charge a fee for admission — even 
as fee-based models have withered away on the rest of the Internet; and 

3. There are relatively few sites that cater exclusively to the under-13 crowd, 
which may be an unintended consequence of COPPA itself. 


35 Gonzales, 478 F. Supp. 775, 805 (E.D. Pa. 2007). 

36 See Federal Trade Commission, Staff Report, Beyond Voice: Mapping the Mobile Market- 
place, April 2009, at 3, www.ftc.gov/reportslmobilemarketplacelmobilemktgfinal.pdf; see also 
FTC Operating Manual, §7.5, at 33, http: II www.ftc.gov Ifoial ch07rulemaking.pdf (The FTC 
“has adopted a policy of reviewing each of its legislative rules (i.e., trade regulation rules and 
rules promulgated under special statutes) at least once every 10 years.”). 

37 144 Cong. Rec. S11657 (daily ed. Oct. 7, 1998) (statement of Rep. Bryan). 

38 Federal Trade Commission, Implementing the Children’s Online Privacy Protection Act: A 

Report to Congress at 28, Feb. 2007, www.ftc.gov/reports/coppa/07COPPA Report to Con 

gress.pdf (2007 COPPA Implementation Report). 

39 Id. at 28. 
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I. Would you support any changes to the rule or to the statute? 

I would support changes to the statute if: 

1. It were shown that those changes were necessary to prevent a demonstrable 
and substantial harm (not just a fear of potential harm), were narrowly tailored 
to that harm, and were the least restrictive means available for addressing that 
harm; 

2. Those changes could reduce the difficulty and expense of complying with 
COPPA, thus promoting competition in the marketplace for children’s content 
and services; or 

3. Those changes could further empower parents to make decisions about their 
children’s participation in online sites and services, without unduly burdening 
those sites and services. 

But as explained throughout, I believe the FTC already has the tools it needs 
under COPPA in its current form. If the FTC needs anything more from Congress, 
it might be additional funding for educational efforts, encouraging new safe harbor 
programs, and targeted enforcement. 

II. Privacy Implications of New Technologies 

A. You said in your written statement, “the reality is that the technology for reliable 
age verification simply doesn’t exist.” Could it exist in the future? If your claim 
is valid, does that mean the business community, the FTC or Congress should 
not strive to find enhanced age verification methods ? 

In a February 2007 report to Congress about the status of COPPA and its imple- 
mentation, the FTC said that no changes to COPPA were then necessary because 
the law had “been effective in helping to protect the privacy and safety of young 
children online.” 40 In discussing the effectiveness of the parental consent 
verification methods authorized in the FTC’s sliding scale approach, however, the 
agency acknowledged that “none of these mechanisms is foolproof.” 41 The FTC at- 
tempted to distinguish these parental consent verification methods from other kinds 
of age verification tools in noting that “age verification technologies have not kept 
pace with other developments, and are not currently available as a substitute for 
other screening mechanisms.” 42 This makes it clear that the FTC does not regard 
the methods the agency has prescribed for obtaining parental consent under COPPA 
as equivalent to strict age verification. 

After years of searching for a technological “silver bullet,” especially by state at- 
torneys general, the practical limitations and dangers of age verification mandates 
are now widely recognized. Few continue to argue for directly mandating 
verification of the age of minors online — or that such verification, in its strictest 
sense, is even technically feasible. Federal courts have found that there is “no evi- 
dence of age verification services or products available on the market to owners of 
websites that actually reliably establish or verify the age of Internet users. Nor is 
there evidence of such services or products that can effectively prevent access to 
Web pages by a minor.” 43 Few public data bases exist that could be referenced to 
conduct such verifications for minors, and most parents do not want the few records 
that do exist about their children ie.g., birth certificates, Social Security numbers, 
school records) to become more easily accessible. 44 Indeed, concerns about those 
records being compromised or falling into the wrong hands have led to legal restric- 
tions on their accessibility. 45 

There are a host of other concerns about age verification mandates. 46 Some of 
these concerns were summarized in a recent report produced by the Internet Safety 


40 Id., at 1. 

41 Id. at 13. 

42 jg 12 

43 Gonzales, 478 F. Supp. 2d 775, 806 (E.D. Pa. 2007). 

44 See Adam Thierer, The Progress & Freedom Foundation, Age Verification Debate Continues; 
Schools Now at Center of Discussion, PFF Blog, Sept. 25, 2008, http : / lblog.pff.org / archives / 
2008 1091 age verificatio l.html. 

45 Various laws and regulations have been implemented that shield such records from public 
use, including various state statutes and the Family Educational Rights and Privacy Act of 
1974, 20 U.S.C. § 1232g, www.ed.gov/policy/gen/guid/fpco/ferpa/index.html. 

46 For a fuller exploration of these issues, see Adam Thierer, The Progress & Freedom Foun- 
dation, Social Networking and Age Verification: Many Hard. Questions; No Easy Solutions, 
Progress on Point No. 14.5, Mar. 2007; Adam Thierer, The Progress & Freedom Foundation, 
Statement Regarding the Internet Safety Technical Task Force’s Final Report to the Attorneys 
General, Jan. 14, 2008, www.pff.org/issues-pubs/other/090114ISTTFthiererclosingstatement.pdf; 
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Technical Task Force, a blue ribbon task force assembled in 2008 by state attorneys 
general to study this issue: 

Age verification and identity authentication technologies are appealing in con- 
cept but challenged, in terms of effectiveness. Any system that relies on remote 
verification of information has potential for inaccuracies. For example, on the 
user side, it is never certain that the person attempting to verify an identity 
is using their own actual identity or someone else’s. Any system that relies on 
public records has a better likelihood of accurately verifying an adult than a 
minor due to extant records. Any system that focuses on third-party in-person 
verification would require significant political backing and social acceptance. 
Additionally, any central repository of this type of personal information would 
raise significant privacy concerns and security issues. 47 

But even if far more robust age verification solutions could be developed, they 
would not solve the central constitutional problem faced by efforts to expand 
COPPA’s age range or scope of sites otherwise covered by COPPA regardless of age. 
This is because, in essence, the practical challenge under COPPA is not that chil- 
dren have to prove that they are in fact under a certain age, but two far more com- 
plicated problems. 

First, once the verifiable parental consent requirement is triggered, either because 
a site is “directed at” children or because the operator knows that a particular user 
is a child (for example, because they have volunteered the fact that they are under 
13 years old), the operator must make a “reasonable effort (taking into consideration 
available technology)” to verify parent-child relationship to ensure that adequate no- 
tice is given to, and authorization is obtained from, someone who is in fact the par- 
ent of that child. 48 This is more complicated than simply verifying the age of any 
particular user, and the statute’s flexibility in exactly how operators are to fulfill 
this requirement is indicative of the difficulty involved. 

Second is the very different problem of trying to ensure that a particular user is 
not a child. This is essentially the problem faced by COPA, where the solution was 
simply to require certain kinds of websites to age verify all users. Again, that solu- 
tion is clearly unconstitutional, even though the material at issue was that deemed 
“harmful to minors” (increasing the government’s interest in regulating communica- 
tions). COPPA’s ingenious way of sidestepping this problem is to limit broad 
verification mandates to sites that are “directed at” children or to situations where 
the operator has “actual knowledge” that a user is a child. (Furthermore, the 
verification required by COPPA is fundamentally different, being verification of 
“verifiable parental consent” rather than of the actual identity or age of a user.) 
This difference is profound, because it means that COPPA, in its present form, does 
not subject significant numbers of adults to age verification mandates. But, again, 
if the COPPA framework were expanded to cover older children or certain websites 
based on their functionality, COPPA would essentially converge with COPA by re- 
quiring large numbers of users to prove a negative: that they are not children. 

It is difficult to see how that problem can ever be solved because even if there 
were a reasonably reliable solution for authenticating a user’s identity, the constitu- 
tional analysis does not hinge on the accuracy of age or identity verification mecha- 
nisms, but on the chilling effects caused by government mandates that users provide 
more information about themselves than they otherwise would have to do in order 
to access certain interactive sites or services (that could potentially allow sharing 
of personal information). Simply put, this does not appear to be a problem that can 
be solved by any amount of technological innovation. 

III. Policy Recommendations 

A. What should the FTC or Congress do to strengthen children’s safety and privacy 
online in conjunction with advanced technologies and mobile devices ? 

1. The FTC Should Clarify COPPA’s Technological Breadth 

As noted above, the FTC should remove any lingering doubt that COPPA is plat- 
form-agnostic. While new technologies may indeed present unique challenges and 
opportunities for “enhancing parental involvement” in the online activities of chil- 
dren, it should be uncontroversial and clear to everyone that COPPA applies to any 


Nancy Willard, Why Age and Identity Verification Will Not Work — And is a Really Bad Idea, 
Jan. 26, 2009, www.csriu.org/PDFs/digitalidnot.pdf; Jeff Schmidt, Online Child Safety: A Secu- 
rity Professional’s Take, The Gardian, Spring 2007, www.jschmidt.org/AgeVerificationl 
Gardian_JSchmidt.pdf. 

47 ISTTF Final Report., supra note 23, at 10. 

48 See 16 C.F.R. §312.1 (definition of “Obtaining verifiable consent”). 
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technology that facilitates the “collection” of personal information over the Internet 
(which, again, means not only collection by operators for advertising or other pur- 
poses but also simply enabling users to make personal information publicly avail- 
able). This is simply the plain reading of the statute. COPPA defines the key term 
“Internet” broadly to mean: 

collectively the myriad of computer and telecommunications facilities, including 
equipment and operating software, which comprise the interconnected world- 
wide network of networks that employ the Transmission Control ProtocoPInter- 
net Protocol, or any predecessor or successor protocols to such protocol, to com- 
municate information of all kinds by wire or radio. 49 

In its 1999 COPPA rulemaking, the Commission declared that: 

The proposed Rule’s definition of “Internet” made clear that it applied to the 
Internet in its current form and to any conceivable successor. Given that the 
technology used to provide access to the Internet will evolve over time, it is im- 
perative that the Rule not limit itself to current access mechanisms. 50 

The Commission rejected a commenter’s suggestion that the agency “clarify that 
the definition ‘clearly includes networks parallel to or supplementary to the Internet 
such as those maintained by the broadband providers . . . [and] intranets main- 
tained by online services which are either accessible via the Internet or have gate- 
ways to the Internet.’” The Commission concluded that its “definition of ‘Internet’ 
was [already] sufficiently broad to encompass such services and adopts that defini- 
tion in the final Rule. 51 The Commission has subsequently incorporated this lan- 
guage into its FAQ, which serves as its primary interpretive guide for those inter- 
ested in understanding application of the rule (especially small site operators): 

The Rule’s Statement of Basis and Purpose makes clear that the term Internet 
is intended to apply to broadband networks, as well as to intranets maintained 
by online services that either are accessible via the Internet, or that have gate- 
ways to the Internet. 52 

As a matter of statutory construction, this interpretation is probably correct and 
would probably receive deference from a court under the Chevron doctrine if chal- 
lenged. 53 This interpretation would allow the FTC to apply COPPA’s requirements 
to services like text messaging and Massively Multiplayer Online (MMO) games like 
World of Warcraft and Second Life that are “accessible via the Internet,” regardless 
of the device used to access them. 

2. The FTC Should Promote Flexibility in COPPA Compliance 

The FTC should take into consideration the unique challenges and opportunities 
raised by new devices and services in deciding how to implement COPPA. Alter- 
native means of establishing verifiable parental consent may work much better for 
the technologies, devices, and services of tomorrow, and the FTC will probably hear 
in great detail about this issue at its roundtable and in comments filed in response 
to its Implementation Review. In deciding how to respond to those suggestions, the 
FTC should aim to maximize the flexibility available to online operators to comply 
with COPPA, and to simplify the process wherever possible for parents and chil- 
dren. Where parents have already given effective consent for their children to use 
a particular service — for example, by paying for a text message plan as part of the 
monthly service for a cell phone — there may be no need to impose additional re- 
quirements because COPPA’s goal of “enhancing parental involvement” through pa- 
rental consent has already been achieved. More granular controls (say, blocking 
texting to a particular number) may be quite valuable to parents but they are prob- 
ably beyond the purview of COPPA and, in any event, are already being offered by 
many service providers in response to parental demand. 54 This suggests the market- 


49 15 U.S.C. §6501(6). 

50 Children’s Online Privacy Protection Rule, 64 Fed. Reg. 59,888, 59,891 (Nov. 3, 1999), avail- 
able at www.ftc.gov / os / 1999 / 10 / 64fr59888.pdf. 

51 Id. 

52 Federal Trade Commission, Frequently Asked Questions about the Children’s Online Privacy 
Protection Rule, Question 6 (“What types of online transmissions does COPPA apply to?”), 
www.ftc.gov / privacy / coppafaqs.shtm. 

53 Chevron U.S.A., Inc. v. Natural Res. Defense Council, Inc., 467 U.S. 837 (1984) (required 
Federal courts to defer to an agency’s interpretation of a statute, so long as the interpretation 
was “reasonable”). 

54 See, e.g. , Verizon Wireless, Usage Controls, https : / / wbillpay.verizonwireless.com / vzw / nos / 

uc / lie home.jsp (describing parental control tools available to parents including blocking num- 
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place is already working to empower parents, which is, after all, COPPA’s primary 
purpose. 

In particular, the FTC could use the discretion afforded to it by the statute to cer- 
tify more “safe harbor” operators, whose self-regulatory guidelines would be deemed 
to be sufficient to establish compliance with COPPA. For example, as children under 
13 increasingly have their own ever more sophisticated mobile phones, 55 wireless 
carriers and mobile operating system developers might collaborate on a standard- 
ized system that requires verifiable parental consent upon the initial purchase of 
a mobile phone service plan or addition of certain options, like text messaging or 
data service but that also provides parents control over which applications their 
children install on their phones. Such a system might work by, for instance, giving 
parents a password-protected account upon the initial verification of their consent 
for the service plan, and then allowing them to easily grant consent for their chil- 
dren to install applications in the future, keep track of those applications for which 
they have already granted consent, access information collected by those applica- 
tions, review the privacy policies of those applications, or revoke their consent as 
they see fit. Such a system is, at least in theory, exactly what policymakers should 
aim to enable, but it may should be required by COPPA. The ultimate goal should 
be to encourage companies to empower parents to manage, as easily as possible, 
their children’s participation in online activities that could entail the sharing of per- 
sonal information — which is what parents are already demanding in the market- 
place. But such a highly complex system should be designed and managed by the 
private sector, not the government, and this is precisely what the safe harbor pro- 
gram provided for by COPPA would allow the FTC to do to the extent consistent 
with COPPA’s scope. 

Concretely, lawmakers might encourage the FTC to issue a call to industry for 
new safe harbor proposals, to work with industry to support the development of 
these proposals, and then perhaps issue a consolidated notice about these proposals 
in order to expedite the notice and comment process required by the statute before 
the agency may grant approval to any new safe harbor program. More such sugges- 
tions will, no doubt, come out of the COPPA Roundtable and comments, and Con- 
gress should encourage the FTC to heed such suggestions. 

Or, the FTC could, as the Implementation Review contemplates, allow operators, 
at least in some circumstances, to use “an automated system of review and/or post- 
ing” to satisfy the existing “deletion exception to the definition of collection.” 56 In 
other words, sites could potentially allow children to communicate with each other 
through chat rooms, message boards, and other social networking tools without hav- 
ing to obtain verifiable parental consent if they had in place algorithmic filters that 
would automatically detect personal information such as a string of seven or ten 
digits that seems to correspond to a phone number, a string of eight digits that 
might correspond to a Social Security number, a street address, a name, or even 
a personal photo — and prevent children from sharing that information in ways that 
make the information “publicly available.” Such a technology would, of course, not 
be foolproof, and might be circumvented by children smart enough to find other 
ways to share information that the algorithm will prevent them from sharing. Yet 
despite these limitations, the FTC should encourage the development of such tech- 
nologies because they could allow sites to meet COPPA’s central goal of limiting the 
sharing of information that could allow the contacting or identification of a child 
without going through COPPA’s intentionally (or at least, necessarily) cumbersome 
parental consent verification procedures. This would benefit kids and operators alike 
by facilitating communication with less risk to children’s online privacy or safety. 

3. Enhanced Enforcement Is Generally Preferable to Expanded Regulation 

Besides promoting empowerment solutions, the FTC should of course be vigilant 
about a second “E-word”: enforcement. As a general matter, before rushing to change 
an existing regulatory regime or give an agency new powers, Congress should al- 
ways ask whether the laws on the books are being given a chance to succeed. Spe- 
cifically, Congress should consider whether the FTC has the staffing, technological 
and financial resources it needs to enforce COPPA’s requirements effectively. 


bers, time restrictions and usage filters); https : / / wbillpay.verizonwireless.com tvzw / nos / uc / 

uc content filter.jsp (content filters); see generally http:/ / parentalcontrolcenter.com /# self; 

http:/ / www.wireless.att.com /learn / articles-resources / parentalcontrols /index.jsp; http:! /shop. 

sprint.com/en/services / safety security / parental control.shtml. 

55 Amanda Lenhart, Rich Ling, Scott Campbell, Kristen Purcell, Teens and Mobile Phones , 
April 20, 2010, http:/ / www.pewinternet.org / Reports / 2010 / Teens-and-Mobile-Phones.aspx. 

56 COPPA Implementation Review, supra note 5, Question 9a. 
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4. Education is Vitally Important 

Finally, the FTC should be encouraged — and funded — to make maximum use of 
the final “E-word”: education. We can and should provide parents with more and 
better tools to make informed decisions about media and communications tools in 
their lives and the lives of their children. But technical tools can only supplement — 
they can never supplant — education, parental guidance, and better mentoring. Edu- 
cation and mentoring are the most essential part of the solution to concerns about 
online child privacy and safety. We can, and must, do more as parents and as a soci- 
ety to guide our children’s behavior and choices online. The FTC has a track record 
of great success in this area, including: 

• OnGuard Online, the website intended to educate all Internet users about on- 
line safety 

• NetCetera, the FTC’s excellent child safety effort 

• The “You Are Here” virtual mall launched by the FTC last year to educate kids 
in 5th-8th grade (ages 10-14) about marketing both online and offline. 

• AdMongo, a game-tutorial website intended to teach kids about advertising and 
marketing, both online and offline, to help them become smarter consumers. 
The service includes a discussion of how information is used for advertising pur- 
poses online. 

In addition, Congress could fund a number of grants for educational efforts in- 
tended to educate kids and parents about online privacy and safety. This approach 
is exemplified by Rep. Wasserman Schultz’s currently pending “Adolescent Web 
Awareness Requires Education Act (AWARE Act)” (H.R. 3630), which would create 
a education grant program to address issues of cybercrime affecting children, includ- 
ing cyber bullying, in schools and communities. 57 Indeed, The “Protecting Children 
in the 21st Century Act,” which was signed into law by President Bush in 2008 as 
part of the “Broadband Data Services Improvement Act,” 63 required that the Fed- 
eral Trade Commission (FTC) “carry out a nationwide program to increase public 
awareness and provide education” to promote safer Internet use and: 

utilize existing resources and efforts of the F ederal Government, State and local 
governments, nonprofit organizations, private technology and financial compa- 
nies, Internet service providers, World Wide Web-based resources, and other ap- 
propriate entities, that includes: (1) identifying, promoting, and encouraging 
best practices for Internet safety; (2) establishing and carrying out a national 
outreach and education campaign regarding Internet safety utilizing various 
media and Internet-based resources; (3) facilitating access to, and the exchange 
of, information regarding Internet safety to promote up to-date knowledge re- 
garding current issues; and, (4) facilitating access to Internet safety education 
and public awareness efforts the Commission considers appropriate by States, 
units of local government, schools, police departments, nonprofit organizations, 
and other appropriate entities. 

Education-based approaches are vital because they can help teach kids how to be- 
have in — or respond to — a wide variety of situations. Education teaches lessons and 
builds resiliency, providing skills and strength that can last a lifetime. That was the 
central finding of a blue-ribbon panel of experts convened in 2002 by the National 
Research Council of the National Academy of Sciences to study how best to protect 
children in the new, interactive, “always-on” multimedia world. Under the leader- 
ship of former U.S. Attorney General Richard Thornburgh, the group produced a 
massive report that outlined a sweeping array of methods and technological controls 
for dealing with potentially objectionable content and online dangers. Ultimately, 
however, the experts used a compelling metaphor to explain why education was the 
most important strategy on which parents and policymakers should rely: 

Technology — in the form of fences around pools, pool alarms, and locks — can 
help protect children from drowning in swimming pools. However, teaching a 
child to swim — and when to avoid pools — is a far safer approach than relying 
on locks, fences, and alarms to prevent him or her from drowning. Does this 
mean that parents should not buy fences, alarms, or locks? Of course not — be- 
cause they do provide some benefit. But parents cannot rely exclusively on those 
devices to keep their children safe from drowning, and most parents recognize 
that a child who knows how to swim is less likely to be harmed than one who 
does not. Furthermore, teaching a child to swim and to exercise good judgment 


57 Adolescent Web Awareness Requires Education Act, H.R. 3630, 111th Cong. (2009), avail- 
able at www.opencongress.org/bill/lll-h3630/show. 
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about bodies of water to avoid has applicability and relevance far beyond swim- 
ming pools — as any parent who takes a child to the beach can testify. 58 

Regrettably, we often fail to teach our children how to swim in the “new media” 
waters. Indeed, to extend the metaphor, it is as if we are generally adopting an ap- 
proach that is more akin to just throwing kids in the deep end and waiting to see 
what happens. Educational initiatives are essential to rectifying this situation. 

B. Do you agree with the direction the FTC is taking as it reexamines the implemen- 
tation and effectiveness of COPPA? 

It’s still probably too early to say with any certainty what that direction is — espe- 
cially on the eve of the FTC’s COPPA Roundtable. In general, I am encouraged by 
the tone of the FTC’s official statements in this proceeding, and also by the oral 
statements of FTC staff at recent events. They appear to have a healthy under- 
standing of the limitations as well as the advantages of COPPA, as well as a 
healthy sensitivity to the potential effects on the competitiveness of the landscape 
for children’s content and services. 

I’m particularly encouraged to see that the implementation review begins by ask- 
ing about the ongoing need for the rule, its costs and benefits, and its unintended 
effects. This is precisely the right way to begin any inquiry into the implementation 
of regulations. COPPA has undoubtedly succeeded in its primary goal of enhancing 
parental involvement in their child’s online activities in order to protect the privacy 
and safety of children online. 59 Yet these benefits have come at a price, since the 
costs of obtaining verifiable parental consent and otherwise complying with COPPA 
have, on the one hand, discouraged site and service operators from allowing children 
on their sites or offering child-oriented content, and, on the other hand, raised costs 
for child-oriented sites. The average cost of compliance may well have fallen from 
the estimate provided to the FTC in 2005 ( $45/child), 60 but even substantially lower 
costs on the order of $5-10 per child could represent a significant barrier to entry 
by sites that must rely, as most online sites and services do, on advertising revenues 
of scarcely more than that — and profit margins far less than that — per user per 
year. We must be realistic about these costs and the trade-offs involved in regula- 
tion. At some point, raising the cost of age verification for sites is simply no longer 
worth the marginal benefit to enhanced parental involvement and, indirectly, online 
child privacy and safety, because these values must compete with other values of 
parents and children, such as the competitiveness, creativity, innovation and diver- 
sity in media and tools available to children online. COPPA in its current form prob- 
ably strikes a reasonable balance, but as noted above, there may indeed be things 
that the FTC can do to lower the costs of compliance for operators, thus allowing 
us to achieve COPPA’s goals at a lower cost to kids and parents in foregone content 
and services. I am also pleased that the Implementation Review asks about the need 
to update the “sliding scale” of parental consent verification methods and to offer 
greater flexibility to site operators, as noted above. 

But I do worry that the Commission has explicitly invited proposals for legislative 
changes to the statute itself. Two questions from the Review are particularly trou- 
bling: 

6. Do the definitions set forth in Part 312.2 of the Rule accomplish COPPA’s 
goal of protecting children’s online privacy and safety? . . . 

28. Does the commenter propose any modifications to the Rule that may conflict 
with the statutory provisions of the COPPA Act? For any such proposed modi- 
fication, does the commenter propose seeking legislative changes to the Act? 

Note that question #6 does not include the critical limitation “consistent with the 
Act’s requirements,” which appears no less than 17 times in subsequent questions 
about specific aspects of the current rules. Whatever the FTC intended by this omis- 
sion, when combined with question #28, it will be taken as an open invitation by 
many commenters to propose not just changes in how the COPPA rules are imple- 
mented, but wholesale revisions to the COPPA statute itself. 

Ultimately, it is the responsibility of Congress, not the FTC, to make decisions 
about modifying the statute. If Congress wants an agency to spend taxpayer re- 


58 Computer Science and Telecommunications Board, National Research Council, Youth, Por- 
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60 See Comments of Parry Aftab, Request for Public Comment on the Implementation of 
COPPA and COPPA Rule’s Sliding Scale Mechanism for Obtaining Verifiable Parental Consent 
Before Collecting Personal Information from Children at 2, June 27, 2005, www.ftc.gov / os / com- 
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sources evaluating whether a substantial change to the agency’s statutory authority 
is warranted, Congress is perfectly capable of authorizing, and appropriating funds 
for, such an inquiry. This is precisely what Congress recently did in the Child Safe 
Viewing Act, when it specifically asked the Federal Communications Commission 
(FCC) to prepare a report on online child safety issues. 61 Similarly, the Recovery 
Act of 2009 charged the FCC with preparing a national broadband plan. 62 Or, where 
less substantial statutory changes are at issue, the Congressional Committee with 
jurisdiction could request that an agency prepare a report to advise that committee. 
But as a general matter, regulatory agencies should not be in the business of reas- 
sessing the adequacy of their own powers, since the natural impulse of all bureauc- 
racy is to grow, and it is through our elected representatives in Congress, not regu- 
latory agencies — even those with the best of intentions — that “We People” are ulti- 
mately represented in deciding how to regulate the online (and offline) world. 63 

Finally I was surprised not to find a single mention of the word “education” in 
the FTC’s Implementation Review Request for Comments. As explained above, just 
about everyone involved in debates about online child safety and privacy would 
agree that the solution begins with education — even if it doesn’t end there. One 
might have thought the FTC would ask about whether effective implementation of 
COPPA’s goals required more education efforts rather than (or perhaps in combina- 
tion with) “stronger” regulations. Again, a layered approach of education, empower- 
ment and enforcement is the best way to enhance the privacy and safety of children 
online, but education is truly the key. 
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Attachment 

Do Smart Phones = Smart Kids? 

The Impact of the Mobile Explosion on America’s Kids, Families, and Schools 
A Common Sense Media White Paper 

April 2010 /Common Sense Media 

Mobile technology is dramatically changing life for all of us, but especially for the 
earliest adopters of all things digital — our kids. Mobile phones and devices give kids 
many new opportunities for entertainment, engagement, and creativity, and make 
it easier to stay connected — including with mom and dad. Unfortunately, the 24/7 
access-anywhere world of mobile also makes parenting even more complicated, and 
many adults worry about the growing challenge of managing the content, applica- 
tions, and connections kids now have at their fingertips. 

In 1983, the first cell phones weighed 28 ounces, measured 10 inches high, and 
sold for thousands of dollars. Today’s mobile phones are often smaller than a deck 
of cards, weigh less than four ounces, and are often free as part of a one- or two- 
year contract. Increasingly, they offer touchscreens, GPS navigation, music, video, 
cameras, e-mail, and Internet browsing, not to mention the ability to download hun- 
dreds of thousands of applications and games. 

In 1985, there were about 200,000 cell phone subscribers in the United States. 
Today, there are more than 286 million subscribers, 1 and nearly nine in 10 (87 per- 
cent) Americans own a cell phone. 2 More than 50 million of them own smartphones 
and wireless enabled PDAs. 3 In addition, purchases of WiFi-enabled devices such as 
cameras, game players, and media players, are expected to increase from 108 mil- 
lion in 2009 to 177 million in 2013. 4 

Increasingly, these handheld devices are becoming miniature computers, enabling 
users to access information and resources from anywhere. One sign of this change 
is the growth of mobile applications — 2.3 billion apps were downloaded in the past 
year alone, and more than five billion will be downloaded per year by 2014. 5 

Mobile Kids 

In 2004, 45 percent of teens had a cell phone; by 2009, it was 75 percent. 6 The 
fastest growth has been among younger teens: 

• In 2004, just 18 percent of 12 year olds had a cell phone, compared to 64 per- 
cent of 17 year olds. 

• In 2009, 58 percent of 12 year olds had a cell phone, compared to 83 percent 
of 17 year olds. 7 

Mobile phone usage is also growing rapidly among younger children. Twenty per- 
cent of U.S. children ages 6-11 currently own a cell phone, up from 11.9 percent 
of children in 2005. 8 

• U.S. teens (ages 13 to 17) send or receive an average of 3,146 text messages 
a month, and kids 12 and under send 1,146 texts per month. 9 

• More than a third of teens download ringtones, IM, or use the mobile web. 

• About a quarter download games and applications. 

• 16 percent use location-based services on their phones. 10 
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130189. shtml. 
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Other Digital Devices 

Most teens use computers to go online, but increasingly, they’re also going online 
with their mobile devices. 

• 27 percent of teen cell phone users use their phone to go online. 

• 24 percent of teens with a game console (like a PS3, Xbox or Wii) use it to go 
online. 

• 19 percent of teens with a portable gaming device use it to go online. 11 

Just over half of teens (51 percent) own a portable gaming device like a PSP or 
a Gameboy. Younger teens are more likely to have them (66 percent of 12-13 year 
olds, compared to 44 percent of 14-17 year olds). 12 Kids can use these devices to 
download TV shows and movies, surf the web, listen to music, and send instant 
messages. 13 Similarly, while the iPod Touch is not a smartphone, it enables users 
to text, access the web, and download apps. Sixty-five percent of iPod Touch users 
are 17 or younger. 14 


11 http :/ / www.pewinternet.orglHeportsl2010ISocial-Media-and-Young-Adults.aspx. 

12 http: / / www.pewinternet.org /Reports /201 0 / Social-Media-and-Young-Adults.aspx. 
13 http: / / us.playstation.com /psp /fullfeatured / index.htm. 

14 AdMob — January 2010 Mobile Metrics Report, http:/ / metrics.admob.com / . 
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How Kids Are Using Mobile Tech 

The Good News 

A variety of recent studies have shown that integrating technology into schools 
can boost achievement in mathematics, literacy, and reading. 15 

• In four North Carolina schools in low-income neighborhoods, 9th- and 10th- 
grade students were given smartphones and special software to help with their 
algebra studies. They used the phones for a variety of tasks, including recording 
themselves solving problems and posting the videos to a private social net- 
working site for their classmates. Students with the phones performed 25 per- 
cent better on the end-of-the-year algebra exam than students without the de- 
vices in similar classes. 16 

• A new study in the U.K. found that text messaging helped children develop 
“phonological awareness” which is key to learning how to spell. The kids who 
text more often (especially those who use abbreviations such as “plz” or “4ever”) 
showed higher scores on spelling exams. Researchers also found that kids who 
received mobile phones at younger ages were better at reading words and iden- 
tifying patterns of sound in speech. 17 

• Teachers in Escondido Union School District in California are exploring the use 
of iPods to improve student reading. Students can record and then hear them- 
selves reading, which helps them work on fluency and comprehension. Teachers 
can import student recordings and create time-stamped digital portfolios to 
track progress. Data from a group of fourth-graders has found that using iPods 
to practice reading resulted in more rapid improvement rates compared with a 
control classroom. 18 

More generally, there are a number of ways that mobile devices can improve edu- 
cation: 

• Mobile devices allow students to gather, access, and process information outside 
the classroom, and can help bridge school, afterschool, and home environments. 

• Because of their relatively low cost, handheld devices can help level the digital 
playing field, reaching and inspiring children from economically disadvantaged 
communities. 

• Mobile devices can support personalized learning experiences, and adapt to the 
individual needs of learners. 19 

The Bad News 

Cyberbullying 

43 percent of kids admit to being cyberbullied, but only 10 percent tell someone 
about it. 

Cyberbullying is when someone repeatedly harasses, mistreats, or makes fun of 
another person online or while using cell phones or other electronic devices. 

• Cyberbully 411 reports that 40 percent of kids say they were cyberbullied 
through instant messenger services; 30 percent said it happened on social net- 
working sites; 29 percent said it happened while playing online games. 

• Cyberbullying is especially prevalent in middle school-aged kids (9-14). 20 
Sexting 

22 percent of teen girls (ages 13-19) say they have sent nude or semi-nude photos 
or video of themselves, either online or via text messages. 

• Messages are even more prevalent than images. Thirty-nine percent of teen 
boys and girls say they have sent sexually suggestive messages (text, e-mail, 
IM), and 48 percent of teens say they’ve received them. 

• Kids who sext may face criminal charges for child pornography or other viola- 
tions, and could be required to register as sex offenders. 21 


15 http: j j www. iste.org / Content / NavigationMenu /Advocacy / Policy / 59. 08-PolicyBrief-F- 
web.pdf. 

16 http: / / www. nytimes.com / 2009 102/161 technology / 1 6phone.html ? r=l . 

17 http: j / www. hritac.ac. uk / news / news.cfm / newsid / 14. 

18 See Appendix A http: / j www.ioanganzcooneycenter.org / pdf / pockets of potential-pdf. 

19 http: / / www.joanganzcooneycenter.org / pdf I pockets o f potential.pdf. 

20 http:/ lwww.commonsensemedia.org/protecting-kids-cyherhullying. 

21 http: j j www. thenationalcampaign.org / sextech I PDF / SexTech Summary.pdf. 



131 


Distracted. Driving 

In 2007, AAA reported that 21 percent of fatal car crashes involving teens be- 
tween the ages of 16 and 19 were the result of cell phone usage. 

According to the National Highway Traffic Safety Administration, in 2008 there 
were 5,870 fatalities and an estimated 515,000 injuries in police-reported crashes 
involving driver distraction, and the highest incidence of distracted driving occurs 
in the under-20 age group. 22 

• 34 percent of texting teens ages 16-17 say they have texted while driving. 

• 52 percent of cell-owning teens ages 16-17 say they have talked on a phone 
while driving. 23 

Cheating 

More than 35 percent of teens with cell phones admit to using their cell phones 
to cheat. 

Kids have always found ways to cheat in school, but now they have more powerful 
tools. 

• 45 percent of teens say texting friends about answers during tests is a serious 
cheating offense, but 20 percent say it’s not cheating at all. 

• 69 percent of schools have policies that don’t permit cell use, but more than half 
of all kids ignore them. 24 

Location-Based Technology 

Mobile phones with GPS capabilities can expose a kid’s exact location. Many new 
programs and apps have been developed that allow kids to announce their phys- 
ical whereabouts. This creates physical safety concerns. 

If a kid shares location info to “friends,” that information can be passed along to 
unintended audiences. Privacy concerns are also a huge issue. Marketers use 
geolocation technology to target kids with promotions. A child’s purchasing habits 
will be registered and personal data collected. Location-based technology raises sev- 
eral critical questions and concerns: 

• Should mobile geolocation data, persistent IP addresses, and other identifying 
information be protected for children under age 13 — in the same way that 
name, age, gender, and address information are protected today? 

• Do teens understand how their personally identifying information will be used, 
and do they need additional protections? 

• Will this identifying information be used to target kids and teens with new be- 
havioral advertising and marketing campaigns? 

Balancing the Good and Bad 

Mobile phones and devices can bring new educational and creative opportunities 
for children. They can also bring increased distractions, and decreased privacy. But 
whether their impact is positive or negative, mobile phones and portable digital de- 
vices are not going away. As parents, teachers, industry leaders, and policymakers 
we must take steps to ensure that kids can access the benefits of mobile technology 
and digital media, while protecting them from potential negative consequences. 

What Parents Can Do 

• Think carefully about whether — and when — your kids need mobile phones and 
devices, and what phone capabilities, like cameras and texting, are appropriate 
for their age. Make sure your kids know your rules about when, how, and how 
often to use them. 

• Know the new ways that kids use mobile phones, including creating, accessing, 
and distributing video, and downloading apps and games. If you don’t know 
what they’re doing, you won’t be able to set the rules. 

• Talk with your kids about privacy and the ways that mobile phones and loca- 
tion-based services can give out their personal information. 


22 http: / / www. nhtsa.dot.gov / staticfiles I DOT / NHTSA /NRD /Multimedia / PDFs / 
Human%20F actors / Reducing%20Unsafe%20behaviors / 811216.pdf. 

23 http: / lpewinternet.org /Reports / 2009 / Teens-and-Distracted-Driving.aspx. 
24 http:/ lwww.commonsensemedia.org/cheating-goes-hi-tech. 
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What Educators Can Do 

• Teach Digital Literacy and Citizenship in K-12 schools, so that all kids learn 
how to use digital — and mobile — devices in smart, effective, and responsible 
ways. 25 

• Establish clear rules about when, where, and how students can — and cannot — 
use mobile phones and devices at school, and encourage dialogue about why mo- 
bile use needs to be limited and responsible. 

• Encourage innovative approaches to using mobile devices to expand positive op- 
portunities for learning, creativity, and communication. 

What Industry Can Do 

• Take increased responsibility for the programs and apps they distribute. 

• Use the same tech innovations that let kids access programs and platforms to 
enable parents to access tools that help them manage their kids’ use of mobile 
devices. 

• Develop better parent controls for mobile devices, and make them easier for 
parents to understand and use. 

• Enable parents to access independent ratings and parent advice through mobile 
devices — for mobile apps and all the other services that kids can now access. 

What Policymakers Can Do 

• Build digital literacy and citizenship programs in schools and communities, in- 
cluding professional development for educators, and a new Digital Literacy 
Corps. 

• Update the Children’s Internet Protection Act (CIPA) and other legislation to 
reduce barriers to students using personal mobile devices on school networks, 
so that schools can decide how to set rules that encourage learning in school, 
at home, and in between. 

• Outlaw texting while driving by all drivers and any use of cell phones by teen 
drivers. 

• Update the Children’s Online Privacy and Protection Act (COPPA) to address 
mobile technology and ensure that children’s privacy is protected on all media 
platforms. 

Mobile phones and devices are becoming mini-computers that enable kids to ac- 
cess every portal and platform of the digital world — from home, school, or any place 
in between. Mobile devices and digital media are changing the ways that kids live 
and learn — and the changes can create opportunities and pose potential dangers. 

Rids today are growing up in a mobile, digital world, and we need to give them 
the digital literacy skills and judgment to access the benefits — and avoid the dan- 
gers — of this world, smart phones will change kids’ lives, we all share a responsi- 
bility for making sure the changes are positive. 

Who We Are 

Common Sense Media is dedicated to improving the lives of kids and families by 
providing the trustworthy information, education, and independent voice they need 
to thrive in a world of media and technology. 

More than 1.3 million people visit the Common Sense website every month for 
age-appropriate media reviews and parenting advice. Tens of millions more access 
our advice and information through our distribution partnerships with leading com- 
panies like Comcast, DirecTV, Time Warner Cable, Cox Communications, Facebook, 
Yahoo, Google, Apple, Disney, Netflix, Barnes & Noble, Best Buy, and others. 

Common Sense Media Board of Directors 

Rich Barton, Chairman and CEO, Zillow.com 

Marcy Carsey, Founding Partner, Carsey-Werner Productions 

Chelsea Clinton, Columbia University 

James Coulter, Founding Partner, TPG 

Geoffrey Cowan, University Professor, The Annenberg School for Communication 
at USC 

April Delaney, President, Delaney Family Fund 

John H.N. Fisher, Managing Director, Draper Fisher Jurvetson 


25 For more information, see the Common Sense Media Digital Literacy and Citizenship 
Whitepaper at http:/ / www.commonsensemedia.org / ahout-us / public-leadership . 
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